The Rise of Juvenile Cybercriminals: Unmasking a Controversial Youth Hacking Ring

*By *

*September 24, 2023*

Over the past two years, a small online community called “the Com” has been implicated in a string of high-profile cybersecurity breaches. The Com, primarily comprised of young people, has become a breeding ground for radicalization and the cultivation of advanced hacking skills. Recent attacks on prominent Las Vegas resorts, as well as other major corporations, have demonstrated the capabilities and danger posed by this youth-led cybercrime ecosystem.

### The Rise of the Com

The Com, known for its brash incursions and provocative language filled with racism and misogyny, has emerged as a significant player in the world of online criminal activity. Researchers who have studied this online community have observed how teenagers and individuals in their early 20s are honing their hacking skills and proudly flaunting their exploits within the Com. The researchers, speaking on condition of anonymity, emphasized the power and capabilities exhibited by this group.

### The Seriousness of the Threat

Policymakers and network defenders have often dismissed the youth-led cybercrime ecosystem as less concerning than state-backed hackers. However, recent breaches, including attacks on Las Vegas resorts, have shattered that perception. One of the Com’s subgroups, “Star Fraud,” was likely involved in the recent high-profile extortion attacks on Caesars Entertainment and MGM Resorts. These attacks highlighted the serious danger posed by the Com and its affiliates.

### Dissecting the Com

It is important to note that the term “Scattered Spider” inaccurately lumps together multiple rival groups from within the Com ecosystem. These groups may share tactics and appear similar, but they are distinct entities. The researchers stress that individuals within the Com learn from each other and constantly refine their methods. This collaboration and shared knowledge make them highly skilled social engineers, particularly adept at convincing IT help desks to hand over valuable corporate credentials.

### The Com Strikes Beyond Las Vegas

The Com’s influence extends far beyond the Las Vegas resorts that were recently targeted. Major corporations such as Nvidia, Samsung, and Microsoft have also fallen victim to attacks by a group known as Lapsus$. Several members of Lapsus$ emerged from the Com ecosystem, highlighting the interconnectedness and reach of this youth-led cybercrime network.

### Addressing the Youth Cybercrime Epidemic

The rise of the Com and its ilk necessitates a concerted effort from policymakers and the cybersecurity community to combat this burgeoning youth cybercrime epidemic. An August 2023 Cyber Safety Review Board report on Lapsus$ recommended that Congress explore funding for juvenile cybercrime prevention programs as part of a “whole-of-society” approach. This is crucial in addressing the radicalization and criminal indoctrination taking place within toxic online communities like the Com.

### The Intersection of Internet Security and Philosophy

The emergence of the Com raises philosophical questions about the nature of online radicalization and its impact on individuals. Cybersecurity experts draw parallels between the Com’s influence and the well-documented issue of how toxic online communities can radicalize children. The Com’s radicalization process turns individuals into not only cybercriminals but also the worst versions of themselves. This highlights the urgent need for both internet security measures and a thoughtful examination of the underlying societal issues that contribute to this disturbing trend.

### Advice for Policymakers and Network Defenders

The involvement of youth in cybercrime necessitates a shift in approach for policymakers and network defenders. Dismissing the youth-led cybercrime ecosystem as a lesser threat is a mistake. It is imperative to recognize the capabilities and danger posed by these young hackers. Policymakers should prioritize funding for juvenile cybercrime prevention programs to disrupt the cycle of radicalization and criminal indoctrination. Network defenders must also adapt their strategies to account for the sophisticated tactics employed by the Com and its affiliates.

In conclusion, the rise of the Com and the youth-led cybercrime ecosystem demands urgent attention from policymakers, network defenders, and society at large. Addressing this issue requires a multifaceted approach that combines internet security measures, funding for prevention programs, and a deeper exploration of the societal factors contributing to online radicalization. Failure to act swiftly and decisively risks the perpetuation of this alarming trend and its far-reaching consequences.