The English village of Bawdsey, with its idyllic cottages and local Parish Council building, seemed sleepy and calm enough. But last month it became a flashpoint in a growing cybercrime conflict that has left the keyboards and brightly lit screens of Telegram chat groups and bled over into physical violence.
A gang of four 16 and 17 year old teenagers dressed in all-black hoodies, sweatpants, coats, and beanies traveled from London to Bawdsey. In the early morning armed with a mix of imitation firearms and real weapons, the group allegedly entered a house and threatened the people inside. The gang then stole multiple watches and a computer before escaping, leaving the house’s occupants shaken.
At 8:30am someone called the police who then responded to the burgled house. Shortly after at 8:45am, police stopped the four boys in a taxi in Alderton, another nearby village. Outside the local pub’s yellow facade police cornered their suspects, before arresting them and taking them off to be questioned.
To outsiders it may have looked like an ordinary robbery—maybe the work of opportunists who heard that the target had items of value. In reality, it was part of a recent wave of violence sweeping across Com, a nebulous online community and culture of predominantly young hackers, criminals, and gamers that has emerged as one of the most pressing cybersecurity issues facing law enforcement today.
According to one message posted on Telegram in the wake of the robbery, the target was one particular hacker in Com, and the person who orchestrated the attack was another hacker in Com. Over the last several weeks there has been a spike of these sorts of attacks, with some people referring to the activity as a “war” inside Com. Besides the robbery, there is evidence of bricks thrown through windows. Seemingly never ending strings of threats on Telegram. Video selfies of people claiming allegiance to one side or another. Resurgence of old doxes and the emergence of new ones.
The recent activity presents a snapshot of what Com is, how it acts, how it is impacting people in the physical world, and how all of this activity is increasingly spinning out of control. More broadly, it cements the idea that for certain groups the gap behind cyber and physical crime is melting away entirely.
“There’s a com world war,” one message posted to Discord reads.
A recent bricking. Image: 404 Media.
The most recent conflict started in March when someone calling themselves “The Punisher” posted the alleged identity of multiple Com members. At least some of these doxes had been posted online before, but others appear to be newly leaked, according to Telegram messages. Some of these doxes targeted members of notorious subgroups within Com, like ACG which I’ve covered in-depth multiple times. Others mentioned are Rolls Royce Cashouts and Star Fraud, the large Telegram group chat which cybersecurity researchers have linked to the compromise of MGM Resorts last year. Com presents a complete intertwining of physical and digital crime, where SIM swapping or social engineering to steal cryptocurrency is just as valid an approach as using violence. They are both methods to achieve the same ends: intimidation, clout, and money. Recent members often get into Com in the first place through communities around Minecraft or Roblox.
A flurry of speculation around the identity of The Punisher followed, and shortly after another channel indicated it was trying to ascertain The Punisher’s identity. People in here claimed they would pay tens of thousands of dollars for more information on who they suspected was behind the moniker, and suggested they team up to target them. “You all sit here wondering ‘who is it’ instead of ‘what do we do to stop it,’” one person wrote. These channels sometimes stretched on for thousands upon thousands of messages across just a few days. Since the conflict started, I’ve eavesdropped on the channels and spoken to people inside Com who provided more photos and videos.
Another channel, called The Battle, claimed they were “reforming” Com by doxing specific members. Another channel called itself The Entity and also posted dox of Com members as well as channels focused on specific young women connected to the community. Some of these channels claimed to have made money through extortion—pay up, and I won’t publish your dox.
Ultimately, it may not matter who is actually behind any one of the channels. Com members have acted violently on these recently resurfaced beefs and their lingering paranoia regardless. Groups are fighting among themselves even when they are seemingly not sure who is responsible for each channel. I have also seen messages in which prominent Com members grill one another about what arrested associates may have told law enforcement. And some members suspect arrests may be coming: “Someone is going to get raided [because] of these channels though.”
Much of the activity appears to be a theatrical play for attention, with channel administrators saying they’ll dox specific people when the channel reaches a certain milestone of subscribers. Some people in the Com laugh in Telegram messages at the tone of the channels. One donned a Darth Vader voice changer and profile picture; someone made a meme mocking one channel as trying to write like Shakespeare. “Holy shit I can’t breathe, he thinks he’s Voldomort,” one person wrote about a channel.
But underneath the pantomime, the violence is sometimes real. Recently since the creation of The Entity channel, a man walked up to a house in the U.S. while filming on his mobile phone. He hurled some sort of object into a window of the house, which smashed violently. “The Entity was here, bitch!” the man yells.
After the robbery in March, members of the Com group chats told me they expected more violence to occur. Several of them then directly sent me more videos of brickings.
In what became a regular routine, I would watch a Telegram channel post another video of violence, or a tipster would send it to me directly, then I would go and verify what actually happened and when. In the case of the robbery, I used clues in the posted photo, such as the distinctive sign on the side of a building and the color of a nearby structure, to determine where exactly it had been taken. With that information, I contacted the local police force to confirm whether a robbery took place. My reporting has been able to confirm some of these videos correspond to actual crimes. In one case I’m still waiting to hear back from the police about an apparent bricking in the U.S.
In another recent case, someone posted a specific address in a UK city and told readers to send people there.
Another video of a bricking shared during the recent conflict. Image: 404 Media.
Members of the channels have also recirculated videos of earlier violence, sometimes to embarrass their targets or participants, or show others what might be to come. The videos show many more brickings, posted to suggest that the targets are not safe in their own homes, with the assailants sometimes saying the specific hacker’s nickname. Another video shows a failed bricking in which the brick seemingly bounced off the house’s window, much to the amusement of people in the Telegram channel. A previously unpublished video of a kidnapped target sat in the backseat of a car with cuts on his head. Another video shows someone peering through a window at a target while they sleep.
In another message, someone posted a photo of a laptop covered in dried blood.
“Times and scenes will repeat,” they added.
“There’s a com world war.”
While this spike in violence was ongoing, the rivalries between particular groups or individuals manifested in other ways too. I joined multiple group video calls during this recent Com activity where participants showed “pof,” or proof of funds. This is where members screen share their device to show the value of the cryptocurrency they currently hold. Some wallets stretched into the millions of dollars. (Sometimes I was kicked out of these calls).
Generally, many members of Com are obsessed with showing they have more money than their rivals, who they say are “poor.” ‘pof 7figs’ and similar are common refrains in the chats, telling people to prove that they have a portfolio of at least $1 million.
As one Com member who helped steal large amounts of cryptocurrency explained to me, obtaining more and more money becomes addictive. Members spend their winnings on cars, property, luxury travel, and clubbing, he said. On Telegram, members share photos of their flashy watches (some real, some apparently fake). One person even shared an appraisal certificate of their watch, to prove its value.
Along with this incessant flexing, a cottage industry of other Telegram channels tracking much of the conflict has popped up. One called “COM DRAMA ALERT” mimics the branding of the popular YouTube channel Drama Alert, run by the YouTube Keemstar. Only here, the channel focuses on “drama” inside Com, including the recent doxes, threats of violence, and other acts.
Some of the information they post is not verified to normal journalistic standards, so this account can’t be taken as gospel. The account sometimes deletes information it later determines to be false, and admitted to me that one photo they posted of an alleged killing was not real and was “posted for publicity.” But at minimum, the Telegram channel shows a stream of videos and photos of Com-related activity. I sometimes obtained material before it appeared in these channels, and other times saw them there for the first time.
One of the challenges in pursuing people from Com is the participants’ young age. “Prosecution of juveniles is obviously a challenge; that’s something we have to adhere to,” David Scott, special agent in charge at the FBI’s Criminal & Cyber Division, said in response to my question at the Verify Rebooting Cybersecurity Coverage for a New Era conference earlier this month. Scott was speaking broadly in response to my question on the challenges of investigating Com, and not about any specific investigation into Com-related people, but said it applies when investigating a “significantly sized group, such as this.” He added that the FBI is working closely with its state and local partners to ensure the agency can still “take action.” The FBI previously arrested Braiden Williams, an alleged member of ACG. Patrick McGovern-Allen, a young man who was hired to firebomb and shoot at homes, was sentenced to 13 years in prison.
At the time of writing, the wider beef in the com is still ongoing but appears to be pettering out in intensity. Some members have deleted their Telegram accounts before potentially reemerging under other ones. When the next spike of violence will happen is unclear, but if there is anything I’ve learned from interacting with this community, it’s that it is highly unpredictable.