The Com and Teen Cybercrime Groups: How Social Engineering Collectives Operate

Some of the most damaging intrusions against large enterprises since 2022 came not from state agencies or long-established crime syndicates but from loose networks of teenagers and young adults who talk their way past help desks and identity controls. The FBI calls the wider ecosystem The Com, short for The Community: an international, mainly English-speaking set of interconnected online networks whose members, many of them minors, commit a range of crimes and form and dissolve groups as needed. Scattered Spider, Lapsus$ and ShinyHunters are the names defenders know, but they are surface expressions of a larger community with shared recruitment routes, shared skills and a common playbook. This guide looks at the ecosystem as a whole: how it is organised, how people are drawn in, the tradecraft its subgroups share, and what enterprises should do differently because of it. It is written for threat intelligence, identity and security operations teams; it is defensive and contains no attacker procedures. For one group in depth, see the Scattered Spider Threat Actor Profile.

Source note: descriptions of The Com and named groups below are summarised from FBI IC3, CISA, the Cyber Safety Review Board, MITRE ATT&CK and Microsoft, as checked in November 2026. Defensive recommendations are NHI Mgmt Group practitioner guidance. Confirm against the official text before relying on it.

Key takeaways

• The Com is an ecosystem, not a group. FBI public service announcements from July 2025 describe interconnected networks, with Hacker Com, IRL Com and Extortion Com as the main subsets, and members moving between them.
• Members are young and recruited online. The FBI states that members typically range between 11 and 25 years old and are drawn in through social media and gaming sites, often through shared interests or existing members.
• Group names change faster than tradecraft. MITRE ATT&CK links ShinyHunters, Scattered Spider and Lapsus$ to The Com and notes overlapping infrastructure and techniques that do not always mean a direct operational relationship; defend against behaviours, not names.
• The shared playbook targets people and identity systems. Help desk impersonation, voice phishing, SIM swapping, MFA fatigue, remote access tools and malicious OAuth app approvals recur across the groups; phishing-resistant MFA and strong help desk verification remove most of it.
• Threats spill into the physical world. Swatting, doxxing and threats against staff and their families are part of the toolkit; security, HR and executive protection need a joint plan.

How the ecosystem is organised

In July 2025 the FBI's Internet Crime Complaint Center (IC3) published an overview PSA, I-072325-3-PSA, alongside separate announcements on each subset. The overview lists motivations as financial gain, retaliation, ideology, sexual gratification and notoriety. The subsets matter to enterprises in different ways.

The FBI's Hacker Com PSA, I-072325-PSA, describes cryptocurrency theft as the main motive for many Com actors, often leading to attacks between members, and swatting used both to distract victims during thefts and as a paid service. It also notes that people often enter through IRL Com, make connections within Hacker Com and build technical skills there. That pathway explains why tradecraft spreads quickly: skills and tools are learned socially, not inherited from an organised hierarchy.

Recruitment and why young people are targeted

The FBI's overview PSA says Com members target young, impressionable people through social media and gaming sites, and that members recruit US juveniles to carry out crimes in the belief that juveniles cannot be prosecuted. The Cyber Safety Review Board's 2023 review of Lapsus$ and related groups made a related point: it described the group as including several juveniles, based mainly in the UK and Brazil, and noted that a perpetrator's juvenile status can yield lighter penalties, which may encourage reoffending.

For defenders this has three practical consequences:

• Persistence and volume: members have time to make many calls and attempts; one refused help desk call is followed by another to a different agent.
• Fluent, native social engineering: MITRE ATT&CK describes Scattered Spider as a native English-speaking group, so call-centre style accents and scripts are not a reliable signal.
• Recruitment of insiders and peers: the CSRB describes Lapsus$ offering money to employees and contractors for access and up to USD 20,000 per week for SIM swaps at telecoms providers. See the Insider Recruitment by Threat Actors guide.

Families and schools have their own part to play in prevention; see the Online Safety Guide for Teens.

Groups and naming

Vendors and agencies track activity as clusters, and the same people may appear under several names over time. The table records how ATT&CK describes the best-known groups; aliases come from ATT&CK's own records, not from this page.

ATT&CK's Salesforce Data Exfiltration campaign (C0059) is a useful example of why names mislead. It records voice phishing by the cluster UNC6040 to compromise Salesforce instances, followed by extortion demands from a separate cluster, UNC6240, claiming to be ShinyHunters, and says the overlaps with Com-linked groups could result from actors operating in the same communities rather than a direct operational relationship. Attribution to a named group should therefore come from government advisories or reporting vendors, and response should not depend on it. See the Lapsus$ Threat Actor Profile and the ShinyHunters Threat Actor Profile.

Shared tradecraft across the ecosystem

The FBI and CISA joint advisory on Scattered Spider (AA23-320A, November 2023) and the CSRB review describe a common set of techniques. They are listed here so defenders can map controls; the page deliberately gives no procedural detail.

CISA AA23-320A recommends phishing-resistant MFA (FIDO/WebAuthn or PKI-based), application allowlisting to block unauthorised remote access software, auditing remote access tools and allowing them only through approved channels such as VPN or VDI, strictly limiting RDP, and segmented, encrypted, immutable and tested backups. The CSRB recommends moving away from voice and SMS MFA to FIDO2-compliant methods and asks carriers to strengthen authentication for SIM changes.

Where identity fits

Almost every step in the shared playbook is an identity event: a reset, a new MFA method, a federation or role change, an approved OAuth app. Non-human identities are a growing part of it. In the 2025 Salesforce data theft campaign, callers persuaded employees to approve a malicious connected app, which then exported data through its own API access without needing the user's password again; see the ShinyHunters Salesforce data theft campaign. Restrict who can approve new OAuth apps, inventory connected apps and integration users, and alert on bulk exports. See the Consent Phishing and Illicit OAuth Grants Guide and How to review Salesforce connected apps and integration users.

What enterprises should do differently

Many organisations built defences for malware-led intrusions. Com-style actors rarely need malware to get in, so the priorities shift.

1. Harden the help desk first: define verification for password and MFA resets that public or stolen information cannot pass (for example, verified video with ID against HR records, or approval by the user's manager through a separate channel), and apply stricter rules to admins and executives. See the Account Recovery and Help Desk Security Guide and the Help Desk Identity Verification Policy Template.
2. Remove phone-based factors: move privileged users first, then all staff and contractors, to FIDO2 security keys or device-bound passkeys. See the Phishing-Resistant MFA Guide.
3. Control remote access tools: allowlist the approved remote support product and block others.
4. Lock down identity administration: just-in-time admin roles, approval for federation and MFA policy changes, break-glass accounts kept offline.
5. Restrict OAuth app approval: admin consent only for new apps in SaaS platforms holding customer data.
6. Extend to outsourcers: the CSRB found organisations did not always consider third parties and BPOs in their risk management; outsourced help desks need the same verification rules and monitoring.
7. Plan for out-of-band communication: Microsoft's guidance on DEV-0537 (Lapsus$) advises monitoring incident response channels for unauthorised attendees; agree a separate channel before an incident.

Small vs large organisations: a small organisation without a 24/7 SOC gains most from steps 1, 2 and 3, which prevent rather than detect. Large organisations with outsourced service desks and many SaaS tenants should prioritise steps 4 to 6 and monitoring, because an attacker needs only one weak tenant or contractor.

Physical threats, swatting and doxxing

The FBI describes swatting as a common entry point into The Com and as a tool to distract victims during thefts, and Extortion Com uses doxxing and threats of violence. During an extortion, employees, executives and their families may be named, threatened or targeted with false emergency reports. Prepare by:

• Reducing exposed personal data: help executives and staff in IT, security and finance remove home addresses and family details from data broker sites. See the Doxxing Prevention Guide.
• Briefing local police in advance where executives are at risk, so a false report can be checked before an armed response.
• Joint playbooks between security, HR, legal and executive protection; see the Executive Doxxing and Personal Data Exposure Playbook.
• Safeguarding routes for staff whose children are targeted: the FBI advises preserving evidence and reporting to IC3, a local FBI field office or NCMEC, and NCMEC's Take It Down service for minors' images.

Detection and threat intelligence

• Help desk telemetry: log every reset and MFA change with the verification method used; alert on resets for privileged users and on several reset calls for one account.
• Identity provider signals: new MFA method followed by sign-in from a new device, new federation or identity provider configuration, admin role grants outside change windows.
• Remote tools: installation or first execution of any remote support product other than the approved one. See Detecting RustDesk, MeshCentral and Tactical RMM Abuse.
• SaaS exports: new connected apps followed by large API exports from CRM or file platforms.
• Intelligence tracking: follow FBI, CISA and reporting vendor publications by technique; record which source assigned each name, and avoid monitoring minors' personal accounts or communities yourself, which raises legal and ethical issues. See the Cybercrime on Telegram Guide for platform context.

Metrics: share of privileged accounts on phishing-resistant MFA; number of SMS or voice factors remaining; help desk resets with documented strong verification; time to detect a new admin role grant; share of SaaS tenants with admin-only OAuth consent; number of unapproved remote tools found per month.

Common failure patterns

• Underestimating young attackers: treating teenagers as nuisance actors leads to under-investment in exactly the controls they defeat. The MGM Resorts breach reportedly began with a help desk call and ended with an estimated USD 100 million impact.
• Defending against a name: blocking indicators for one group misses the next cluster using the same playbook.
• Help desk verification by knowledge questions: employee IDs, dates of birth and manager names are all findable or purchasable.
• Leaving SMS and push MFA for admins: SIM swapping and MFA fatigue remain the cheapest bypasses.
• Coordinating response on compromised chat: attackers inside Teams or Slack read containment plans.
• No plan for threats to people: doxxing and swatting during an extortion catch HR and executives unprepared.

Practitioner checklist

• Track Com-linked activity by technique, recording the source of every group name.
• Require verification for help desk resets that public or purchased information cannot pass, including at outsourced service desks.
• Move privileged users, then all staff and contractors, to phishing-resistant MFA and remove SMS and voice factors.
• Allowlist one approved remote support tool and alert on any other.
• Put identity administration behind just-in-time access and change approval, with alerts on new admins, MFA changes and federation changes.
• Restrict OAuth app approval in SaaS platforms holding customer data and monitor bulk exports.
• Agree an out-of-band communication channel for incident response.
• Build a joint security, HR and executive protection plan for doxxing, swatting and threats to staff.

Standards and references

• FBI IC3: The Com: Theft, Extortion, and Violence are a Rising Threat to Youth Online
• FBI IC3: Hacker Com: Cyber Criminal Subset of The Community (Com) is a Rising Threat to Youth Online
• CISA and FBI: Scattered Spider (AA23-320A)
• Cyber Safety Review Board: Review of the Attacks Associated with Lapsus$ and Related Threat Groups
• MITRE ATT&CK: Scattered Spider
• Microsoft Security: DEV-0537 criminal actor targeting organizations for data exfiltration and destruction
• MITRE ATT&CK: ShinyHunters
• MITRE ATT&CK: Salesforce Data Exfiltration

Related NHI Mgmt Group resources: Scattered Spider Threat Actor Profile · Vishing and Help Desk Social Engineering Awareness Guide · SIM Swap Fraud Guide · MFA Fatigue and Bypass Guide