‘Most egregious exploitation’ ever seen: Violent online extortion groups raise alarm

Law enforcement action has accelerated and senators are taking new legislative action against a cybercrime movement whose raison d’être is sowing terror and chaos, where young victims are coerced into self-harm or harm to others, and where those arrested — often young themselves — are accused of committing heinous crimes to gain extortionist cred in “The Com.”

“For years NCMEC has responded to child sexual exploitation; however, the emergence of sadistic online exploitation, a recent trend perpetrated by violent online groups, has led to the most egregious exploitation reports NCMEC has ever seen,” National Center for Missing and Exploited Children Executive Director Lauren Coffren said in written testimony to the Senate Judiciary Committee today for a hearing focused on protecting children online.

“Com” is short for “The Community,” described by the FBI as “a primarily English-speaking, international, online ecosystem comprised of multiple interconnected networks whose members, many of whom are minors, engage in a variety of criminal violations.” This includes hackers who are sometimes linked to ransomware groups, groups that incite and commit acts of real-world violence including property crimes and assault, and actors who specialize in swatting (pulling an extensive police response to a location with a false report) or bomb threats as well as doxing (releasing personal information on otherwise anonymous people online) in exchange for a cryptocurrency fee.

Some, but not all, of those who identify as being part of Com also engage in extortion activities. Victims, who are most often minor females and may be especially vulnerable due to mental health issues such as depression, are drawn or recruited into specific online social networks from other public online platforms including popular gaming sites. Extortion Com members work to gain trust through means such as leading the victim to believe they are cultivating a relationship. After the victim gives the Com members something of value — personally identifiable information, intimate photos or explicit video, for example — the Extortion Com members threaten to release these materials on the internet or send explicit images to the victim’s family, or extorters threaten to harm the victim, their parents or siblings if their demands are not met.

Once the victim agrees to the Com members’ demands in order to avoid exposure or violence, the harm inflicted can include forcing the victim to commit degrading acts or even suicide on a livestream. In addition to self-harm including cutting or producing pornographic content, victims may be told to hurt others such as siblings or animals. In October, for instance, a grand jury returned an indictment against Tony Christopher Long, 19, of Porterville, Calif., for two counts of animal crushing in addition to allegations that he sexually exploited a minor victim in Washington state.

‘Never seen anything like this’

Their activities fall under nihilistic violent extremism (NVE) — essentially, accelerating societal chaos and violence for the sake of violence, with related groups using names that reflect this ideology such as “No Lives Matter.”

Extortion groups within Com go by a variety of monikers, with 764 being one of the most well known. Those who have track records of extortion and share the photographic or video evidence of these crimes with like-minded members gain clout in the online community. Groups compete to outdo each other in the scope of their brutality.

“We’ve never seen anything like this,” National Center for Missing and Exploited Children Communications Director Patricia Davis wrote in a blog post describing reports to the organization’s CyberTipline as “some of the most sadistic online enticement reports we’ve ever seen.”

Between Jan. 1, 2019, and June 30, 2025, reports to the CyberTipline in which age and gender were noted reflected that 84% of victims were female while 75% were ages 14 to 17, 21% were ages 11 to 13, and 4% were 10 years old or younger. Eighty-eight percent of the offenders were male, and 25% of those were minors. During the first six months of this year, NCMEC’s tipline received 1,093 reports with a nexus to a violent online group — a 115% increase — and there was a 1,500% increase in reports from 2022 to 2024.

Erik Lee Madison, 20, of Halethorpe, Md., an alleged 764 member, was indicted last month on three counts of sexual exploitation of a child, three counts of coercion and enticement of a child, and one count of cyberstalking after Discord reported concerning chats to the NCMEC CyberTipline. The affidavit alleges that Madison told a minor victim “to kill her sister’s dog” and “said the ‘lowest age he would go’ is 8 or 10 years old.” When he was a minor, Madison was investigated in 2020 for a child pornography report (also submitted to the CyberTipline), was investigated in a 2022 online child exploitation case and was charged as a juvenile for posting a 2022 video of him sexually abusing his dog.

FBI Director Kash Patel said in an X post today that there has been an “almost 500% increase in Nihilistic Violent Extremism arrests and over 20% increase in FBI arrests directly related to 764 network.”

Last week, the Justice Department announced the unsealing of a November indictment in the U.S. District Court for the Eastern District of New York charging five men — Hector Bermudez, 29, of Queens, N.Y., Zachary Dosch, 26, of Albuquerque, N.M., Rumaldo Valdez, 22, of Honolulu, David Brilhante, 28, of San Diego and Camden Rodriguez, 22, of Longmont, Colo. — with operating “Greggy’s Cult” from 2019 to 2021 on a series of Discord servers. Within these chats, the indictment says, members would direct minors “to engage in sexually explicit or other degrading conduct” on a video call and capture images.

Both minor and adult victims were exploited and harassed, prosecutors allege, with the group at times “urging minors to abuse their siblings and to kill themselves, including encouraging a minor victim to overdose on medication or hang himself/herself from a ceiling fan.” One case cited in the indictment alleges that three of the members extorted an adult victim by threatening to publicly accuse the person of being a pedophile unless the victim “engaged in a variety of degrading acts on a live video call.”

After Greggy’s Cult came 764, founded in 2021 by Bradley Cadenhead, then a 15-year-old in Stephenville, Texas, who went to prison in 2023 on an 80-year sentence for child pornography charges.

“There are no federal statutes that adequately criminalize the coercive conduct of 764 and similar groups,” Jessica Lieber Smolar, former assistant U.S. attorney in the Western District of Pennsylvania, told the Senate Judiciary Committee in written testimony today. “As federal prosecutors, we focused on proving more conventional statutory violations, like CSAM possession or production, or distribution of obscenity to minors, to effectively prosecute these horrific crimes.”

Before today’s hearing, Judiciary Chairman Chuck Grassley (R-Iowa) and Ranking Member Dick Durbin (D-Ill.) introduced a package of bills: the Sentencing Accountability for Exploitation Act (SAFE Act), which would require the U.S. Sentencing Commission to develop a new child sexual abuse material sentencing guideline that accounts for modern indicators of especially dangerous conduct; the Ending Coercion of Children and Harm Online Act (ECCHO Act), which would create a new crime punishable by possibly life in prison that prohibits individuals from coercing children into physically harming themselves, others or animals; and the Stop Sextortion Act, which would increase the maximum penalty for these types of offenses from five to 10 years.

Terrorism nexus

Though NVEs may show no distinct ideological leanings, with violence being a goal in and of itself, influence or adherence to other extremist ideologies is sometimes seen in these circles as well as imagery borrowed from occultist movements.

Marek Cherkaoui, 21, of Egg Harbor Township, N.J., was arrested last month on cyberstalking offenses in relation to his alleged connection with 764. According to the criminal complaint, Cherkaoui berated one victim, “Cut deeper. I’m offering to send razor blades to your house so you do it right. Also, do it live on camera next time so you get more famous.” He allegedly bragged about his “kill count” when learning of a potential suicide and threatened to dox and swat victims. “You need to slit.your.wrists. Then you need to take a picture and send it to me,” he allegedly told a victim in December 2024. “Do it or I’ll make your life miserable.”

Cherkaoui allegedly praised the December 2024 shooting at a Nashville school as “god like” and posted about making and using triacetone triperoxide (TTAP), an explosive used in the May 2022 Manchester Arena bombing. Cherkaoui wrote that TTAP is “good stuff, very easy to make with easily acquirable materials,” the criminal complaint alleges, and also wrote that “it is best to use steel ball bearings as shrapnel.” He allegedly posted links to “Terrorgram Publications” and “Power Grid Sabotage Manual,” and advised others on ways to conceal these instructional materials.

Between December 2022 and April 2025, prosecutors allege, Cherkaoui had books about manufacturing explosives, zip ties, body armor and other tactical gear delivered to his home. A search of his house in June allegedly uncovered a note written in May 2023 in which Cherkaoui said all Pentagon employees, whom he accused of “devil worship” and being Freemasons, “deserve to die.”

“Someone should just nuke it or gas it with chemical weapons just f–king everyone inside,” Cherkaoui allegedly wrote. “Wipe DC off the map… The pentagon is a threat to the white race.” In September of that year, he allegedly wrote, “I need to make my life count by taking others with me.”

Even after that search by law enforcement was conducted, the complaint says, Cherkaoui got a new cell phone and “continued to make threatening and disturbing posts online,” including posting on Sept. 22 that “764 is my favorite honestly because the[y] go after … minority kids … which is awesome… Better for them to be removed when they’re young before they grow up and become a bigger problem … They marginalized [i.e., minority] kids are a very good high-value soft target for 764 and the other groups should take note.” He also allegedly made antisemitic posts and called school shooters “the only good.”

Baron Cain Martin, 21, of Tucson, Ariz., faces charges include child exploitation, conspiracy to provide material support to terrorists, conspiracy to kill kidnap or maim persons in a foreign country, use of interstate commerce facilities in the commission of murder-for-hire, production and distribution of child pornography, cyberstalking and animal crushing. It’s the first use of terrorism charges against an alleged 764 member.

A 39-page superseding indictment filed in the U.S. District Court for the District of Arizona on Oct. 29 says Martin was a leader and administrator of CVLT, a precursor to 764, from as early as 2019 until December 2024. In August 2022, Martin was allegedly an author of a guide posted on encrypted social media channels that instructed others how to identify, groom, acquire explicit content from and extort underage victims — particularly targeting girls already committing self-harm or suffering from eating disorders. Vulnerable children were coerced into doing sexual acts on live video chats, prosecutors allege, and cutting phrases into their skin including “Convict owns me” — Martin’s screen name — and symbols such as swastikas and satanic symbols.

In 2022, the indictment alleges, Martin offered $3,000 on social media for someone to kill one of his underage victims and that person’s relative, telling other 764 members that paying for a hit would be “easier” than kidnapping. The terrorism charge cites Martin’s alleged authorship of the grooming guide as well as various extortion activities, including involving an 18-year-old victim in a foreign country.

“The charge provides a valuable clarification,” Luke Baumgartner and Barry Jonas assessed today at Just Security. “By deploying a statute traditionally reserved for international terrorism, or more recently, other types of domestic terrorists, the DOJ has signaled that NVE networks like 764 are terrorist enterprises. They are engaged in organized campaigns of violence and coercion designed to terrorize, destabilize and degrade society to the point of total collapse. By charging Martin with conspiring to provide material support to terrorists, the shift represents a long-overdue recognition that such conduct is not just depraved — it is terrorism.”

While both victims and perpetrators are usually minors or young adults, Richard Densmore, a 47-year-old Michigan man, was sentenced in November 2024 to 30 years for sexually exploiting children as a member of 764. The Justice Department said Densmore “became notorious” for creating and boosting membership in Discord communities “where members recruited children — including by infiltrating online gaming sites that children frequent — to cut themselves and engage in graphic sexual acts.”

“He threatened victims to cut themselves by telling them, ‘I have all your information. I own you. … You do what I say now kitten,'” DOJ said.

Coffren told senators today that 69% of the sadistic online exploitation reports NCMEC received last year came from members of the public such as parents or the child victims, while online platforms submitted less than a third of the reports.

“It is unacceptable that online platforms have failed to take essential steps to detect, disrupt and report SOE activity on their services and instead we rely on child victims and their friends and parents/caregivers to report these incidents,” she said. “There is a significant gap in the industry’s awareness and response to evolving exploitation on their platforms.”