# "The Com" cross-platform criminal ecosystem: Discord/Telegram/Roblox/Minecraft/X abused for malware distribution, extortion, and predatory recruitment

> Flashpoint documents a decentralized, FBI-tracked criminal ecosystem known as "The Com" that operates across mainstream platforms rather than the dark web: Discord's CDN and webhook infrastructure are abused to distribute RATs/infostealers and bypass corporate security perimeters, Telegram serves as a marketplace and coordination hub, Roblox and Minecraft are scouting grounds for a predatory recruitment pipeline that grooms isolated minors before migrating them to encrypted channels for sextortion, and X is used to amplify ransomware data-leak extortion. Subgroups including 764, Extortion Com, and the FBI-tracked Scattered Spider syndicate have driven federal prosecutions, a July 2025 FBI/IC3 nationwide alert, and ~300 active FBI investigations as of late 2025.

- **Published:** 2026-08-26T00:00:00Z
- **Last reviewed:** 2026-08-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2155
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-the-com-youth-predation-ecosystem-tl-2026-2155.webp?v=75985a74 (Threadlinqs threat intel: The Com Youth Recruitment Ecosystem: Detection & IOCs (TL-2026-2155) — High severity, 23 IOCs, 9 detection rules.)
- **ID:** TL-2026-2155
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** The Com
- **Detections:** 9 (1 shown free below) · **IOCs:** 23

## Description

The Com ("The Community") is a decentralized, primarily English-speaking online ecosystem of loosely affiliated cybercriminal and predatory subgroups, operating chiefly through Discord, Telegram, Roblox, Minecraft, and X rather than dark-web infrastructure. The FBI and IC3 describe thousands of participants, disproportionately minors and young adults aged roughly 11-25, organized into recognized subsets: Hacker Com (financially motivated cybercrime, malware development, ransomware-as-a-service affiliation), IRL Com (violence-for-hire, armed robbery, shootings), Extortion Com (sextortion and CSAM production targeting minors), and 764 (a violent, ideologically-tinged network that coerces minors into self-harm, suicide attempts, animal cruelty, and CSAM production, with documented overlap into neo-Nazi/accelerationist networks such as M.K.U.). Scattered Spider (also tracked by MITRE as Octo Tempest/UNC3944/Roasted 0ktapus, G1015), the syndicate behind the 2023 MGM Resorts breach, the 2024 Snowflake customer-data extortion campaign, and 2025 UK retail ransomware intrusions (including DragonForce ransomware deployment), is publicly linked by the FBI to The Com's Hacker Com subset.

On the malware-distribution side, security vendors (Morphisec, Zscaler, Trend Micro, Trellix, Centripetal, Intel 471) have independently documented threat actors abusing Discord's CDN (cdn.discordapp.com / media.discordapp.net) to host and serve infostealers and remote access trojans, exploiting the fact that corporate network defenses commonly allowlist Discord domains, letting malicious traffic blend with legitimate application activity and bypass perimeter controls. The "SYK Crypter" service has been used to package and deliver AsyncRAT, njRAT, QuasarRAT, Warzone RAT, and NanoCore RAT via Discord-hosted payloads; separate campaigns push RedLine Stealer and Lumma Stealer via Discord CDN links, and a mid-2025 campaign abusing expired/recycled Discord invite links delivered AsyncRAT, Skuld Stealer, and the ChromeKatz cookie/session-token harvester to exfiltrate credentials, browser cookies, and Discord session tokens — in some cases using Discord's own webhook/API infrastructure as an exfiltration and C2 channel. Researchers have counted roughly 10,000 malware samples that leverage Discord infrastructure for distribution or C2.

On the predatory-recruitment side, Flashpoint and multiple child-safety/legal analyses describe a repeatable pipeline: (1) scouting — recruiters identify socially isolated, depressed, or attention-seeking minors on Roblox, Minecraft, and public Discord servers; (2) trust-building — "love bombing" through gifted in-game currency, subscriptions, or a romantic facade to create psychological obligation; (3) migration — moving the target from a platform's public, moderated spaces into private Discord servers or encrypted apps, isolating them from safety tooling (a documented "public-to-private" strategy). Once isolated, victims are coerced into producing sexual imagery or self-harm content, which is then used for blackmail, doxxing threats, and further extortion. Extortion Com has specifically operated fake "suicide-prevention" Telegram support chats to social-engineer isolated minors into disclosing identifying information later used to doxx and extort them. Discord alone forwarded 489,782 suspected child-exploitation reports to NCMEC in 2025 (over 1,300/day).

Other documented Com tactics weaponize consumer-facing infrastructure for both cybercrime and real-world violence: SIM swapping and IP-grabbing to deanonymize and locate victims; OSINT-based doxxing; DDoS-for-hire; swatting and hoax bomb threats; cryptocurrency theft and money laundering; and, on the Scattered Spider/Hacker Com side, telephone- and SMS-based helpdesk impersonation to obtain credential resets and MFA transfers ahead of ransomware deployment. X (Twitter) is used post-compromise to publicly broadcast proof of breaches and amplify pressure on ransomware/data-leak-site victims during extortion negotiations.

Federal response has been active and sustained: a May 2024 FBI tradecraft alert on 764 doxxing practices; the November 2024 sentencing of 764 operator Richard Anthony Reyna Densmore ("Rabid") to 30 years for child sexual exploitation; the October 2024 arrest and subsequent guilty plea of Connor Riley Moucka for the Snowflake-linked extortion campaign; a July 23, 2025 FBI/IC3 public service announcement (PSA250723-3) and a July 28, 2025 follow-on alert tying Com cybercrime to physical violence; a July 29, 2025 updated joint advisory on Scattered Spider tactics; FBI Director Kash Patel's November 2025 disclosure of roughly 300 active investigations into the 764 network with arrests across 23 countries; and continued congressional oversight pressure on the FBI's response into 2026.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1598.004 Spearphishing Voice
- T1585.001 Social Media Accounts
- T1608.001 Upload Malware
- T1566.003 Spearphishing via Service
- T1204.002 Malicious File
- T1684.001 Impersonation
- T1451 SIM Card Swap
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1102.002 Bidirectional Communication
- T1567.002 Exfiltration to Cloud Storage
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Discord CDN Malicious Payload Download Followed by RAT Execution** (`TL-2026-2155-SPL-001`)

Detects a file downloaded from Discord's attachment/CDN infrastructure (cdn.discordapp.com / media.discordapp.net) followed within minutes by execution of a non-browser process, consistent with SYK Crypter-packaged RAT delivery (AsyncRAT, njRAT, QuasarRAT, Warzone RAT, NanoCore RAT) documented in The Com's Discord-abuse campaigns.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.003, T1204.002, T1608.001
- **Data sources:** proxy, sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype="stream:http" OR sourcetype="pan:threat"
(url="*cdn.discordapp.com/attachments/*" OR url="*media.discordapp.net/attachments/*")
(url="*.exe" OR url="*.scr" OR url="*.bat" OR url="*.js" OR url="*.vbs" OR url="*.zip" OR url="*.rar")
| rename dest_ip as download_host
| join type=left dest_ip
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-15m
      | eval parent_is_browser=if(match(ParentImage, "(?i)chrome|firefox|msedge|discord"), 1, 0)
      | table dest_ip, Image, CommandLine, ParentImage, parent_is_browser, _time ]
| where isnotnull(Image)
| table _time, src_ip, download_host, url, Image, CommandLine, ParentImage
| sort -_time
```

### Microsoft KQL

```kql
let discordCdnHosts = dynamic(["cdn.discordapp.com","media.discordapp.net"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (discordCdnHosts)
| where RemoteUrl matches regex @"\.(exe|scr|bat|js|vbs|zip|rar|dll)(\?|$)"
| project Timestamp, DeviceId, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessParentFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","discord.exe")
    | project Timestamp2 = Timestamp, DeviceId, FileName, ProcessCommandLine, InitiatingProcessParentFileName
) on DeviceId
| where Timestamp2 between (Timestamp .. Timestamp + 10m)
| project Timestamp, DeviceName, RemoteUrl, FileName, ProcessCommandLine, InitiatingProcessParentFileName
```

### Sigma

```yaml
title: Discord CDN Payload Download Followed by Suspicious Process Execution
id: c1a2e4d6-8b3f-4a1e-9c7d-2f5b6a1e3d40
status: experimental
description: Detects a file downloaded from Discord's CDN/attachment infrastructure followed by execution of a non-browser process, consistent with SYK Crypter-packaged RAT delivery observed in The Com's Discord-abuse campaigns.
references:
  - https://www.morphisec.com/blog/syk-crypter-discord/
  - https://www.zscaler.com/blogs/security-research/discord-cdn-popular-choice-hosting-malicious-payloads
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-26
tags:
  - attack.initial-access
  - attack.t1566.003
  - attack.execution
  - attack.t1204.002
  - attack.resource-development
  - attack.t1608.001
  - attack.tool.async_rat
  - attack.tool.njrat
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\Discord\app-*\Discord.exe'
  selection_ext:
    Image|endswith:
      - '.exe'
      - '.scr'
  filter_signed:
    Image|contains: '\Program Files\Discord\'
  condition: selection_parent and selection_ext and not filter_signed
falsepositives:
  - Users legitimately running executables received as Discord attachments from known/trusted contacts
level: high
```

**Known false positives:**

- Users legitimately running executables received as Discord attachments from known/trusted contacts

**Tuning notes:** Scope the join window to the environment's typical browser-to-disk-to-exec latency (start at 10-15m) and exclude a maintained allowlist of IT-approved Discord community servers used for legitimate file sharing.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SYK Crypter RAT Delivery via Discord Invite-Link Redirect Chain (locked: unlock with TL Creds)
- Helpdesk Impersonation Vishing Leading to MFA Reset / SIM-Swap-Enabled Account Takeover (locked: unlock with TL Creds)
- Dynamic-DNS (DuckDNS/DDNS Geek) Beaconing to Com-Linked RAT Infrastructure (locked: unlock with TL Creds)
- Suspicious Process Execution from Discord Cache/Downloads Directory (locked: unlock with TL Creds)
- Suspicious Process Memory Access to Browser Process Consistent with In-Memory Cookie Extraction (locked: unlock with TL Creds)
- Non-Browser Process Network Connection to Discord Webhook or Com-Linked Dynamic-DNS C2 Domain (locked: unlock with TL Creds)
- Infostealer Browser Credential and Cookie File Harvesting (RedLine/Lumma/ChromeKatz Pattern) (locked: unlock with TL Creds)
- Discord Webhook API Used as Stealer Exfiltration/C2 Channel (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Understanding Illicit Ecosystems: Mainstream Apps & Social Infrastructure](https://flashpoint.io/blog/understanding-illicit-ecosystems-mainstream-apps-social-infrastructure/)
- [The Com: Theft, Extortion, and Violence are a Rising Threat to Youth Online (PSA250723-3)](https://www.ic3.gov/PSA/2025/PSA250723-3)
- [Product ID: AA23-320A — Scattered Spider (updated joint advisory)](https://www.ic3.gov/CSA/2025/250729.pdf)
- [FBI: Thousands of people involved in 'The Com' targeting victims with ransomware, swatting](https://therecord.media/fbi-the-com-ransomware-swatting-alert)
- [FBI alerts tie together threats of cybercrime, physical violence from The Com](https://cyberscoop.com/fbi-warning-the-com-cybercrime-extortion-violence/)
- [Understanding The Com: A New Cybercrime Model](https://www.blackfog.com/understanding-the-com-a-new-cybercrime-model/)
- [FBI intensifies crackdown on international '764' child exploitation network](https://wjla.com/news/nation-world/fbi-intensifies-crackdown-on-international-764-child-exploitation-network-crimes-kash-patel-children-federal-authorities)
- [Member Of Violent 764 Terror Network Sentenced to 30 Years in Prison For Sexually Exploiting a Child](https://www.justice.gov/usao-wdmi/pr/2024_1107_Densmore_A_Sentenced)
- [Canadian citizen allegedly involved in Snowflake attacks consents to extradition to US](https://cyberscoop.com/connor-moucka-snowflake-hacker-extradition-us/)
- [Canadian Suspect Arrested Over Snowflake Customer Breach and Extortion Attacks](https://thehackernews.com/2024/11/canadian-suspect-arrested-over.html)
- [SYK Crypter Distributing Malware Families Via Discord](https://www.morphisec.com/blog/syk-crypter-discord/)
- [Malware Distribution Uses Discord CDN](https://www.zscaler.com/blogs/security-research/discord-cdn-popular-choice-hosting-malicious-payloads)
- [Beware: Lumma Stealer Distributed via Discord CDN](https://www.trendmicro.com/en_us/research/23/j/beware-lumma-stealer-distributed-via-discord-cdn-.html)
- [Discord Invites Are Leveraged in Malware Distribution](https://www.centripetal.ai/threat-research/discord-invites-leveraged-in-malware-distribution)
- [How Discord is Abused for Cybercrime](https://www.intel471.com/blog/how-discord-is-abused-for-cybercrime)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2155