The threats began quietly, then escalated into something far more sinister. In the spring of 2024, anonymous accounts using the handles “Waifu” and “Judische” flooded Telegram and Discord channels with violent messages aimed at cybersecurity researcher Allison Nixon. The posts promised gruesome harm. Soon, others joined in, sharing harassing content including AI-generated images meant to intimidate her.
For Nixon, chief research officer at Unit 221B, the harassment was both personal and professional. She had spent more than a decade tracking cybercriminals, often infiltrating their chatrooms under aliases, quietly gathering evidence until law enforcement could step in. Her work had helped identify and dismantle numerous hacking operations, particularly a loose, amorphous online subculture known simply as “the Com.”
The Com is not a traditional criminal organization. It has no headquarters, no clear hierarchy, and no single platform where members gather. Instead, it exists as a shifting constellation of mostly teenage and twenty-something hackers spread across North America and Europe, coordinating through forums, encrypted messaging apps, and ephemeral online communities. What binds them together is not ideology but a volatile mix of notoriety, financial ambition, and digital rebellion.
Over the past decade, their activities have evolved dramatically. Early members launched nuisance-level distributed denial-of-service attacks, overwhelming websites for bragging rights. But as cryptocurrency values surged in the late 2010s, the group pivoted toward more lucrative crimes: SIM-swapping schemes, ransomware attacks, data theft, and crypto fraud. Their targets have included major corporations such as AT&T, Microsoft, and Uber.
Some factions pushed even further, crossing into offline violence. Investigators have linked splinter groups to swatting attacks, physical assaults, and campaigns of sextortion that coerced victims into self-harm or explicit acts. One offshoot, known as 764, has been accused of encouraging acts ranging from stabbings to animal abuse. The decentralized nature of the Com makes it particularly difficult to combat; unlike nation-state hackers, its members are unconstrained by diplomatic consequences or geopolitical caution.
A veteran cybercrime researcher described the group as uniquely dangerous precisely because it lacks those limits. Governments such as Russia or China must weigh retaliation and international law. The Com, by contrast, operates with anarchic freedom.
Nixon saw the threat long before most of the cybersecurity world took notice. In 2011, while working night shifts at SecureWorks, she began exploring hacker forums that others dismissed as playgrounds for “script kiddies.” She found something else: young offenders leaving digital breadcrumbs everywhere. Casual boasts about crimes were peppered with revealing details about hometowns, schools, and habits. By correlating these fragments, she realized it was often possible to unmask individuals hiding behind pseudonyms.
Her approach differed from conventional threat intelligence. Rather than focusing only on technical exploits, she studied personalities, motivations, and social dynamics. She read endless chat logs, watching rivalries and egos play out in real time. That patience paid off repeatedly, allowing her to identify rising actors years before they became headline-making cybercriminals.
One early validation came when journalist Brian Krebs became the victim of a swatting attack in 2013. Nixon joined a small circle of investigators analyzing clues that eventually led to the perpetrator. The collaboration cemented her path as an independent cyber sleuth.
By 2020, at Unit 221B, she had built a system to preserve massive volumes of hacker communications before they vanished. The platform, known internally as eWitness, aggregates scraped conversations from Telegram, Discord, and forums into a searchable archive used by researchers and law enforcement. Former hackers even helped design tools to capture these fleeting digital traces.
The timing proved crucial. The pandemic drove a surge in online activity and isolation among young people, accelerating recruitment into the Com. Nixon observed how social alienation, economic frustration, and the lure of cryptocurrency wealth pulled newcomers into increasingly serious crimes. What began as digital mischief matured into coordinated fraud rings capable of stealing millions.
Loose-knit crews such as Star Fraud, ShinyHunters, Scattered Spider, and Lapsus$ emerged from this ecosystem, collaborating on high-profile breaches and extortion campaigns. Financial gain became central, but status and ego remained powerful motivators. Members often sabotaged their own schemes through reckless boasting—behavior Nixon learned to exploit.
The harassment campaign against her in 2024 marked a turning point. After hackers infiltrated cloud-storage accounts tied to a vendor of AT&T and accessed billions of call records, Nixon’s phone number appeared among the stolen data. Soon afterward, Waifu and his associates began taunting her online, apparently believing she was aiding investigators.
Their threats had the opposite effect. Nixon redirected her attention to identifying them.
Her investigative method resembled building a widening web. She mapped every persona connected to the suspects, analyzed rivalries and alliances, and scrutinized arguments for inadvertent disclosures. Enemies and former associates often revealed more than friends, she found, offering candid insults that exposed personal details.
The suspects attempted counterintelligence, planting false leads and probing other researchers for information. It was an unusual escalation, signaling that some Com members were becoming more sophisticated not just technically but socially.
Despite the misdirection, Nixon and collaborators narrowed their focus to a single individual: Connor Riley Moucka, a 25-year-old Canadian living in Ontario. After months of coordination with authorities, the Royal Canadian Mounted Police arrested him in October 2024. Prosecutors allege that Moucka, linked to the Waifu persona, participated in extortion schemes that netted millions of dollars from stolen data. He has pleaded not guilty; his case is ongoing.
Another alleged associate, U.S. Army soldier Cameron John Wagenius, was arrested weeks later and has already pleaded guilty to charges related to trafficking confidential phone records.
For Nixon, the arrests were milestones but not an endpoint. Members of the Com continue to taunt her online, and she continues to monitor them, convinced that persistence is the key to dismantling networks that rely on anonymity and time.
Her work underscores a broader shift in cybercrime. The most disruptive threats are no longer exclusively state-sponsored espionage units but decentralized digital-native communities whose members grow up online, learn criminal techniques socially, and treat hacking as both livelihood and identity.
“They keep going until they get arrested,” Nixon has said of the young offenders she tracks. “It just takes years.”
In that long game, patience may be the most powerful weapon.
This article is based on an excerpt from a report originally published in MIT Technology Review.
