Loading threat actor…
The Com, also referred to as Comm, is a loose, predominantly English-speaking cybercriminal collective rather than a single tightly controlled intrusion set. It encompasses or overlaps with multiple subgroups and personas, including Scattered Spider and LAPSUS$, and has been associated with aggressive social engineering, credential theft, extortion, doxxing, and in some cases ransomware-enabled operations conducted by affiliated groups. The collective is commonly described as fluid and difficult to disrupt, with activity coordinated across online communities and shifting brands or subgroups. Operationally, Com-affiliated actors are strongly associated with human-centric intrusion tradecraft. Reported techniques include impersonating employees, contractors, or internal IT staff in phone-based social engineering; manipulating help desks into resetting passwords or enrolling unauthorized MFA devices; directing victims to phishing pages that capture credentials, MFA codes, and session material; and abusing compromised enterprise identities to access cloud services. In cloud intrusions, affiliated actors have been observed rapidly identifying and exfiltrating sensitive data from Microsoft 365 services such as SharePoint and OneDrive, then using compromised internal communications channels including email and Microsoft Teams to pressure victims with extortion demands. The collective has also been linked to publication of stolen or exposed personal information relating to government personnel, indicating willingness to conduct doxxing and harassment-oriented operations in addition to financially motivated intrusions. Reporting on Com-linked and Com-affiliated activity further connects the ecosystem to data-theft extortion and, through subgroups such as Scattered Spider and LAPSUS$, to ransomware and double-extortion incidents against major enterprises. Known associated or overlapping names in public reporting include Scattered Spider, UNC3944, Octo Tempest, Muddled Libra, Oktapus, Scatter Swine, Star Fraud, and LAPSUS$. Overall, The Com is best understood as an amorphous cybercriminal ecosystem centered on social engineering, identity compromise, cloud data theft, extortion, and related post-compromise abuse, with financially motivated operations as the dominant pattern.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as background context in relation to prior targeting of a researcher; not described as involved in the DfE/PNLD intrusion.
Loose cybercriminal community associated with aggressive social engineering campaigns; mentioned as the broader network with which Pink appears affiliated.
A broader cybercrime network with which Pink is believed to be associated.
Com-affiliated groups are referenced as commonly using vishing for initial access, harvesting credentials and MFA codes via phishing pages, rapidly exfiltrating data from SharePoint and OneDrive, and using compromised accounts for extortion via email and Microsoft Teams.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.