Understanding The Com: A New Cybercrime Model

Hacker Com focuses on technical crime: ransomware, phishing, SIM swapping, IP theft, malware development, and account compromise.

IRL Com enables physical violence-for-hire, extortion, and coercion linked to online disputes.

Extortion Com targets vulnerable individuals, particularly minors, using doxxing, blackmail, and CSAM coercion.

Security analysts have identified Scattered Spider (a.k.a. UNC3944 / Octo Tempest / 0ktapus) as an operational evolution of the Hacker Com faction, with shared TTPs and infrastructure dating back to notable breaches at companies like HubSpot, Twilio, Cloudflare, Riot Games, Coinbase, Reddit, and MGM.

Scattered Spider has expanded into ransomware deployment, often as an affiliate deploying ALPHV/BlackCat-based payloads. The group’s criminal infrastructure includes access brokering, social engineering, and targeted phishing designed to facilitate human-operated ransomware attacks.

Tactics, Techniques & Procedures

• Initial Access & Credential Access
• Spear-phishing, social-engineered password resets of helpdesk/admin accounts.
• SIM-swapping and VoIP techniques enable account takeover and lateral privilege gain.

Modular, Burnable Toolkits

• Direct deployment of customized malware drop loaders and “burner” payloads built to evade behavioural and signature-based EDR detection.

Access Brokering Economy

• Initial access sold within cells or to ransomware affiliates and state-linked actors.
• Ecosystem model: multiple adversaries buy into the same network intrusion for different monetization objectives.

Ransomware & Double Extortion Deployments

• Scattered Spider affiliates deploy BlackCat/ALPHV payloads and other malware variants.
• Data theft precedes encryption, maximizing pressure through reputational and regulatory risk.

Real-World Violence as Leverage

• IRL Com subsets coordinate threats, kidnapping, or extortion to coerce victims or brag within the network.

Real-Time Threat Prevention for Dynamic Cybercrime Cells

In a cyber landscape increasingly shaped by human-operated threats, organizations need more than reactive alerts, they need 24/7 real-time prevention. BlackFog delivers exactly that.

With its unique anti data exfiltration (ADX) technology, AI based behavioral threat detection, and dynamic blocking capabilities, BlackFog helps organizations prevent breaches by ensuring unauthorized data never leaves the network.

For organizations with lean internal teams, BlackFog’s vCISO services provide expert leadership, streamlined incident response, and compliance-ready reporting, all tailored to the demands of that specific industry.

Visit blackfog.com or contact us at sales@blackfog.com