A decentralized cybercriminal ecosystem rather than a single gang. It is held together by shared language, status, social channels, and reusable tradecraft, which means the same behaviours can persist even when handles, brands, or individual operators change.
What The Com Represents
The Com is not a single organisation with a stable hierarchy. It is a distributed criminal ecosystem sustained by shared slang, reputation, social channels, and reusable tactics, so membership, branding, and operator identities can change while the underlying methods and relationships persist.
That matters because disruption of one persona or channel rarely ends the ecosystem. The network effect is social and operational, which makes it more resilient than a conventional gang structure and harder to map through a single leadership target.
How The Com Persists
The Com persists by lowering the friction of participation. Common language, status signalling, and repeatable tradecraft let newcomers learn fast, borrow credibility, and plug into existing scams, extortion, fraud, or intrusion workflows without needing a formal organisation chart.
That also means the ecosystem can survive rebranding and fragmentation. When one handle disappears or one channel is moderated, participants often migrate rather than dissolve, carrying the same playbooks and social norms into new venues.
What Makes The Com Operationally Dangerous
The danger is scale and continuity. A decentralised criminal ecosystem can coordinate opportunistic abuse across many actors, while the shared identity of the community helps preserve trust, recruitment, and monetisation even when individual accounts are burned or banned.
This structure creates a practical advantage for adversaries: it supports rapid reuse of proven techniques, faster diffusion of successful fraud patterns, and a lower barrier for less-skilled participants to adopt high-impact tradecraft. MITRE ATT&CK Enterprise Matrix is useful here because it helps defenders describe the repeated tactics that often recur across otherwise different operators.
How Defenders Should Read It
Defenders should treat The Com as an ecosystem problem, not a single-threat-actor problem. That means focusing on recurring infrastructure, repeated lures, reused tooling, and behavioural patterns that survive handle changes, rather than assuming a name change implies a new adversary.
At the control level, visibility and response benefit from combining account, network, and content analysis so that community migration is seen as continuity, not disappearance. NIST Cybersecurity Framework 2.0 helps structure that kind of detection-and-response view, while NIST Privacy Framework is relevant when investigations and moderation workflows must handle personal data carefully.
Risk and Threat Considerations
The main risk is persistence through decentralisation. When a criminal ecosystem is held together by reputation and reusable methods, removing one account, forum, or alias may not reduce the broader threat, because the social graph and tradecraft can re-form elsewhere.
Failure mechanism: Trust, status, and shared operating patterns create continuity across changing identities, allowing recruitment, fraud, and coordination to keep working after individual operators are exposed.
Impact: Defenders may underestimate the threat, misattribute incidents to isolated actors, and miss the recurrence of the same techniques across different handles, channels, or campaigns.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001 — Initial Access | The Com is defined by recurring adversary tradecraft that ATT&CK helps map. |
| Recommendation — Map repeated behaviours to ATT&CK techniques and hunt for recurrence across campaigns. | ||
| NIST CSF 2.0 | DE.AE-02 — Anomalous Events are Analyzed | The ecosystem’s recurring patterns require analysis of linked anomalous activity. |
| RS.CO-02 — Incidents are Coordinated with Stakeholders | Response to a distributed criminal ecosystem depends on coordinated abuse handling and escalation. | |
| Recommendation — Correlate repeated signals across incidents to distinguish ecosystem continuity from isolated abuse. Coordinate incident response across trust, abuse, and threat-intel teams when handles or channels change. | ||
Practitioner Guidance
What to watch for: Look for repeated tradecraft, common language, overlapping infrastructure, and reused social signals across incidents, even when the apparent actor names differ. That is often the clearest sign that you are dealing with a durable ecosystem rather than separate one-off offenders.
Governance implication: Escalation, takedown, intelligence, and abuse-response processes should be designed to preserve continuity of evidence and pattern recognition across incidents, so that one disruption does not reset the defender’s understanding of the network.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org