Hacker Com: Cyber Criminal Subset of The Community (Com) is a Rising Threat to Youth Online

The Federal Bureau of Investigation is warning the public about Hacker Com, one of three subsets of the growing and evolving online threat group known as The Com, short for The Community. The Com is a primarily English speaking, international, online ecosystem comprised of multiple interconnected networks whose members, many of whom are minors, engage in a variety of criminal violations. Members of Hacker Com typically have a shared interest, ideology, or goal and work together, adding others to the group and splintering when necessary, to achieve their mission.

Hacker Com involves a broad community of technically sophisticated cyber criminals, some of whom are linked to ransomware-as-a service (RaaS) groups. Members of Hacker Com often sell technical services for a profit and use their technical capabilities to steal cryptocurrency to fund other criminal activity. Computer-related criminal activity within Hacker Com includes, but is not limited to, distributed denial-of-service (DDOS) attacks, compromise of personally identifiable information, sale of government email accounts, ransomware attacks, phishing, malware development and deployment, cryptocurrency theft, computer intrusions, and subscriber identity module (SIM) swapping¹. Hacker Com actors use tools such as: remote access trojans, phishing kits, voice over internet protocol (VOIP) providers, voice modulators, virtual private networks (VPNs), spoofing technology, cryptocurrency cash out services, live streaming services, and encrypted email domains to facilitate their criminal activity and conceal their true identities. While many of these tools and methods are used throughout the entirety of The Com, some are more prevalent within Hacker Com subgroups. Open-source information indicates Hacker Com groups are responsible for high-profile attacks and intrusions and have affiliations with ransomware organizations.

Cryptocurrency theft is the primary motivator for many Com actors, which often leads to internal conflicts and Com members themselves becoming the targets of SIM swaps and other cyber-related crime. Perceived slights, membership in a rival group, or boasts about cryptocurrency balances can provoke Com actors to attack each other. Notoriety and perceived status within Hacker Com groups are derived from a member's skill sets and account balances. Members screen share and brag about profits resulting from cryptocurrency thefts, which sometimes exceed millions of dollars. In many cases, this leads to a member becoming a target of cryptocurrency theft. In addition to SIM swapping and network intrusions, physical extortion is another means of stealing cryptocurrency. This can involve kidnapping, torture, threats of violence toward family members, and the use of firearms. The intensification of these online conflicts has resulted in the emergence of a new layer of The Com known as In Real Life (IRL) Com, which includes subgroups that aim to facilitate real world acts of violence, oftentimes resulting from online conflicts. Members may start their Com participation in IRL Com, make friends with other members in Hacker Com, develop the necessary cyber skills, and then begin participating in Hacker Com while continuing their association with IRL Com. Others may use funds gained through participation in Hacker Com to participate in Extortion (Extort) Com. Extortion Com primarily involves the exploitation of children. Members extort minors, typically females, through threats of doxing², swatting³, and IRL violence if member demands are not met.⁴