764
Content Warning: this brief contains materials related to sexual violence, physical abuse, and psychological abuse.
764 is a network[1] of online groups that engage in sextortion and the glorification of violence. The network, which comprises a constantly shifting landscape of splinter groups and offshoots, forces minor victims to produce Child Sexual Abuse Material (CSAM). They then use that CSAM as leverage to force victims to perform acts of violence, animal abuse, or self-harm. They also engage in extensive swatting, harassment and intimidation campaigns to silence their victims. Since 2021, at least ten 764 members (or members of affiliated groups) have been arrested for sextortion, possession of CSAM, or violent attacks. Court records have also revealed the influence of extremist groups and ideologies on the 764 network, including the Satanist neo-Nazi group The Order of Nine Angles. This Explainer will describe the background, tactics, and interconnectivity of the network to facilitate better understanding by law enforcement, policy-makers, the general public and those who may come in contact with victims.
Background/origin
764 emerged in 2021 from the “Com Network,” an online community that focused on swatting while also engaging in sextortion and online Child Sexual Abuse Material (CSAM) distribution. 764 was formally created in 2021 by then-15-year-old Texas resident Bradley Cadenhead. While Cadenhead claims that the group was co-founded by an associate he met through the online game Minecraft, that individual has never been identified. Cadenhead named 764 after his hometown’s ZIP code, and took inspiration from a similar online network that engaged in sextortion of minors known as “CVLT.” Recent court filings have also demonstrated the ideological influence of the satanic neo-Nazi Order of Nine Angles (O9A) on CVLT.
Media reporting on the 764 network has largely focused on its activities on Discord. However, the network initially began on the messaging app Kik, using online platforms including Roblox, Snapchat, Instagram and Telegram to target and contact victims. Cadenhead’s 2023 arrest for extortion and creation/distribution of CSAM, along with the internal conflict and competition inherent to the network, has led to the creation of various 764 offshoots. These include 676, CVLTIST, Court/Courtbox, Kaskar, Harm Nation, Leak Society and H3ll which are still considered to be part of the network due to their shared aesthetics, history, and focus on sextortion.
764 groups operate in tight, hierarchical structures and have developed somewhat sophisticated tradecraft to avoid law enforcement scrutiny, as detailed in recent research based on leaked chat logs. Leaders of 764 subgroups strictly control the access of those seeking to join the network and often require them to provide proof of illegal activities before granting access. This complicates law enforcement investigations while encouraging acts of violence or criminality among young online users seeking acceptance into the group.
Tactics
764 and its affiliated groups engage in extreme anti-social behaviors that can be roughly divided into three categories:
- Sextortion and circulation of CSAM
- The glorification and encouragement of violence
- Threats or violence intended to intimidate victims
These activities commonly target minors or other vulnerable victims. They are generally driven by a desire to gain status within the group rather than ideology or profit.
Sextortion and circulation of CSAM:
Sextortion is the trademark activity of the 764 network. While there is some variation in their methods, 764 members generally follow tactics contained in manuals circulated among the group to threaten their victims and obtain CSAM or other compromising materials. Members collaborate to identify vulnerable victims online, use social engineering or feigned romantic interest to obtain compromising photos of the victim, and then use the images as leverage to extort further compromising imagery or force the victim to carry out an act of self-harm, violence or animal abuse. Each victim is generally targeted by a single perpetrator. However, their exploits are often shared with the network in Telegram or Discord chats.
The nature of 764’s sextortion often complicates law enforcement responses. 764 members have carried out acts of violence themselves but often prefer to extort others to self-harm, abuse animals or harm others. This degree of separation often means that local law enforcement must manage a complex web of encrypted communications and frequently deleted chatrooms spanning multiple jurisdictions to investigate what are often low-level felonies or even misdemeanors. It is also common for the victims of 764 extortion to be manipulated into extorting others, creating a self-perpetuating chain of victims and perpetrators.
Acts of violence:
764 is best known for its sextortion activities, but elements of the network have increasingly focused on encouraging acts of nihilistic violence. The most prominent violent subgroup, No Lives Matter (NLM), has been linked to multiple violent attacks and foiled plots over the last year, including two stabbing sprees in Sweden.[2] NLM members also glorify former attackers as martyrs online and produce propaganda encouraging acts of violence. Group members and prospective members observe these acts and may believe that they can gain status or acceptance by imitating them, forming a key driver of future attacks.
NLM also seeks to use previous attacks as propaganda to encourage further violence. Attacks are filmed, set to music and shared online in the hopes of inspiring others to engage in violence. One of the Swedish attackers also vandalized buildings near the site of his attacks with “764 x NLM” and shared photos of the graffiti online prior to his arrest. Since his incarceration, he has become a celebrity within 764 spaces online. Videos of his attacks are regularly shared and he was also named in a subsequent publication released by the group.
Intimidation and swatting:
Historically, 764 members have discouraged victims from reporting their abuse through swatting and false reports to law enforcement. In addition to threatening to release their intimate photos, 764 members often threaten to swat the victims’ families or friends. However, in two recent cases, the network resorted to more traditional methods of criminal coercion, hiring others located near the victim to intimidate them through real-world action such as firebombings or shootings. These individuals are usually hired from other portions of the Com network focused on traditional criminal activity, demonstrating the increased cross-pollination between these groups.
Notable arrests and attacks
CSAM distribution and victim intimidation
At least a dozen US-based 764 members, including four network leaders, were arrested between 2021 and 2024 in connection with sextortion, CSAM offenses and crimes against minors. There was little available knowledge of the international network until the arrest of Angel Almeida in 2023. The New York-based 22-year-old, arrested initially for possession of a firearm, received additional charges after he spent months coercing two minors into producing CSAM for him. Almeida, known online as “Duck”, “necropedocell” and “Stain_Lord_354”, possessed substantial amounts of Nazi and O9A memorabilia at the time of his arrest.
In 2021, Bradley Cadenhead, the founder of 764, was arrested in Texas for possession and distribution of CSAM. The then 16-year-old, who used the online handles “brad764”, “felix” and “felix764”, manipulated minors into sending him self-produced CSAM and videos of themselves committing bodily mutilation or animal abuse. Before creating 764, Cadenhead was associated with precursor CVLT, led by now-25 year old Texas resident Kaleb Merrit. Merrit was arrested in Georgia in 2021 for kidnapping and raping a pre-pubescent girl and subsequently charged with additional CSAM and grooming offenses.
Kyle Spitze, another prominent member of the network, was arrested in 2024 in a case that highlighted the traumatic circumstances and upbringings of some members. Spitze, known online as “criminal”, distributed a video in 2023 on Discord of his mother’s boyfriend shooting him, followed by a video of his mother’s corpse after she had overdosed on drugs. The 24-year-old belonged to a 764 offshoot group called “HarmNation”; he was arrested in 2024 for producing self-harm videos of minors and CSAM, including sexually explicit material of a 12-year-old.
Not all CSAM/intimidation arrests occurred in the US. France-based Rohan Rane, European leader of 764 precursor CVLT, was arrested in 2022 for child sex abuse crimes. The 28-year-old produced substantial amounts of CSAM by subjecting victims to grooming, degradation, self-harm and online violent content. His demands included encouraging minors to eat their own hair, drink their own urine, degrade themselves with racial slurs, produce videos of cut signs (i.e. cutting their extortionist names into their bodies) and livestream their suicides. If victims resisted, he sent compromising images of the victims to their family and friends.
Offline violence and targeted attacks
European 764 and affiliated group members were responsible for at least three stabbing sprees between 2022 and 2025. These attacks often appear to imitate a 2022 stabbing by a member of the nihilistic group Maniac Murder Cult (MKY), which is not a core part of the 764 network but is closely allied. In that incident “Tobbz”, a German national, filmed himself murdering an elderly Romanian woman and attempting to murder an elderly man, which he carried out in order to gain entry into MKY. “Tobbz” was arrested by Romanian authorities in 2022 for murder and possession of child pornography.
In 2025, Swedish authorities arrested a NLM member who was under the age of 15 for stabbing a woman in 2022 and posting the video to X (formerly Twitter) and Discord channels associated with 764. Another Swedish 14-year-old from Hasselby was apprehended in 2024 in connection with two stabbing incidents from that same year. The teenager, known as Slain764, is a prominent member of NLM and claimed to “run the NLM cell” in Sweden. Slain764 had also shared footage on Telegram with 764 members that he claimed showed him stabbing at least eight individuals.
US-based 764 members have terrorized their victims through both offline and online attacks. Between 2023 and 2024, two individuals who are part of the 764 network hired hitmen from the Com network to firebomb and shoot at their victims’ homes in Pennsylvania. However, the most common method of intimidating victims remains swatting. A 17-year-old girl from Connecticut was arrested in 2024 for a series of swatting and bomb threats made to local schools, religious institutions and libraries. It is unclear whether the acts were done to terrorize victims, or whether she was the victim and was coerced into it by other members. In 2023, 20-year-old Nathanial Deleon used swatting calls to target a victim who tried to cut off contact with Deleon. When these failed, he called the victim’s school and claimed the victim was a school shooter who had placed pipe bombs there.
Offshoots and related groups
764 has created alliances with online neo-Nazi and accelerationist groups. It also remains the most well-known group within the wider Com network and has spawned numerous offshoots. However, constant rebranding and splintering makes it difficult to determine whether a newly identified group is an offshoot, an allied group or simply a subgroup of 764 that has given itself a unique name. Common features across the network include socially transgressive behavior and a focus on sextortion.
While some subgroups such as NLM formed into independent offshoots, others remain under the 764 umbrella. Analysts have observed elements of 764 using a variety of names over the past five years including CVLTIST, Court, Kaskar, Harm Nation, Leak Society, 7997, 8884, 2992, 555, Slit Town, 545, 6996, 404, NMK, 303, SR1 and XVN. Some of these names represent unique identifiers, but others, such as 6996[3], are borrowed from other internet subcultures, creating further confusion among non-members and those not immersed in the history of these subcultures. When new group names appear, analysts are often unable to determine whether new groups are being created or old groups are being rebranded.
Alliances between groups in the network can be similarly complex. While members often identify as a member of a specific group, they generally operate in online spaces shared by the entire network (and often other extremist elements). This often minimizes the value of alliances, as group members often prioritize their relationships with other individual users over inter-group politics. For example, while NLM announced in May 2024 that it was no longer affiliated with 764, analysts continue to observe crossover in membership across the groups’ Telegram channels.
764 groups also exist in similar online spaces as neo-Nazis and accelerationists, leading to further crossover. While 764’s presence on Discord is generally siloed, its Telegram channels operate in similar networks belonging to various neo-Nazi and accelerationist groups, including Terrorgram and MKY. Some members of 764 and affiliated groups have adopted aspects of those ideologies and analysts have identified some individuals who are members of two or more groups.
MKY is the most notable official “ally” of the 764 network. MKY is a nihilistic, neo-Nazi, accelerationist group based in Russia and Ukraine that glorifies violence. The group is known for highly-stylized videos and images showing their members attacking the unhoused. The group, which is also known as MMC and MKU, has claimed credit for numerous murders although there is insufficient evidence to verify these claims. MKY ideological and instructional handbooks are often shared in 764 spaces. Notably, the 3rd edition of the MKY’s “Hater’s Handbook” claims formal alliances with a variety of groups including NLM, but there is little indication that these alliances have resulted in joint action.
Additional Resources
- National Center for Missing and Exploited Children (NCMEC): NCMEC is a non-profit organization which works to prevent the exploitation and victimization of children through providing a variety of services.
- TakeItDown: TakeItDown is a free service provided by NCMEC which facilitates the removal of non-consensual intimate imagery from participating online platforms. Victims submit images to be added to TakeItDown’s hash-sharing database, preventing further victimization.
- CyberTipline: The CyberTipline is NCMEC’s central hub for reporting both online and offline child exploitation. NCMEC can provide direct support to victims who report through the CyberTipline, as well as connecting them with law enforcement resources.
- FBI Internet Crime Complaint Center (IC3): Formerly known as the Internet Fraud Complaint Center, the IC3 is the FBI’s central hub for reporting any “cyber-enabled crime”, including hacking and online extortion. IC3 provides an online portal for victims and associated individuals to report online crimes to the bureau.
Glossary
Lorebook: Documents made by 764 members as a means of extorting and/or doxxing a victim. They are typically comprised of sexually explicit images of the victim, messages between a victim and extorter, and/or images of the victim self-harming. Members of the 764 network threaten to send lorebooks to family/friends of victims to increase control over a victim.
SIM Swapping: The practice of porting a target’s phone number to a new subscriber identity module (SIM) card. These attacks give a perpetrator access to nearly all of the contents of a target’s device and accounts. Certain sectors of the Com network conduct SIM swaps on a for-hire basis and these services are an essential piece of extortion schemes within 764.
Com: Short for “The Community”, the Com network is a loosely defined network of online hackers, extortionists and other criminals. 764 exists as part of the Com network and regularly utilizes services from other portions of the network. Common services offered within the Com network include swatting, SIM swapping, doxxing and “bricking” (the practice of throwing a brick through a target’s window). Some parts of the Com network have also engaged in major hacking efforts, including the 2023 MGM Grand hack. There are some indications that members of the Com network may be connected to hostile state actors.
Cut signs/Cut signing: The practice of forcing a victim to carve their extorter’s name into their own bodies. This custom likely originates from the online practice of “fansigns.” These cut signs often show up in lorebooks published within the 764 network and are used as status symbols. Perpetrators within the network view these cut signs as a means of “claiming” or otherwise demonstrating ownership of their victims. The extremity of the cut sign is also directly tied to status within the network, as deeper or more graphic cuts demonstrate a greater degree of control over the victim.
[1] The term 764 is commonly used by researchers, media, and law enforcement to refer to the entire network of sextortion groups described in this Explainer; however, some members of the network refer to themselves by sub-group names and do not self-identify as members of 764.
[2] Additional information on these attacks is detailed in a subsequent section.
[3] While its exact origins and meaning are unverified, 6996 is a Russian alternate reality game (ARG) featuring gore and snuff materials. The number is thought to reference the date of the last execution in Russia, which took place in 1996.
_________________________________________________________________________________
This Explainer was published on 27 March 2025.
