# Europol Called It Extremism. That Should Tell You Something About Where 'The Com' Ended Up.
When law enforcement agencies start using the language of counter-terrorism to describe a cybercrime network, something has fundamentally shifted. Europol's decision to flag 4,340 URLs for removal as part of a sustained crackdown on "The Com" is notable not just for its scale — it's notable for what the agency chose to call this collection of loosely affiliated online groups: nihilistic violent extremists.
That's not language Europol applies to ransomware gangs. It's not how they describe fraud networks or even nation-state APT crews. That framing matters, and the security community has been slow to reckon with what it actually means.
## From Hacking Boards to Body Counts
The Com didn't start as a violent extremist movement. It grew out of the same chaotic substrate that produced SIM-swapping rings and teenage hacking crews — Discord servers, Telegram channels, gaming communities, and the fringes of the English-speaking internet where bored young men competed for status through increasingly dangerous stunts.
The progression was grim and predictable in retrospect. Social engineering gave way to SIM swapping. SIM swapping funded real money. Real money attracted people willing to threaten, extort, and eventually physically harm targets. Swatting attacks that used to be punchlines became coordinated operations. Kidnappings for cryptocurrency occurred. People died.
Scattered Spider — the group responsible for the 2023 MGM Resorts and Caesars Entertainment breaches that collectively cost those companies over a billion dollars — operated in adjacent circles. Lapsus$ drew from similar talent pools. The underground infrastructure for The Com and these high-profile criminal enterprises wasn't separate. It overlapped, federated, and fed each other.
Europol's operation targeting 4,340 URLs is effectively trying to raze the recruiting grounds.
## The Content Takedown Gamble
Here's the honest read on URL removal campaigns: they work better than critics claim and worse than agencies imply.
The optimistic case is real. Removing content disrupts recruitment pipelines, forces community migration that fragments coordination, and imposes operational costs on groups that rely on stable infrastructure for communication. When the FBI seized RaidForums in 2022 and BreachForums in 2023, both operations genuinely disrupted specific criminal workflows even if successors eventually emerged.
The pessimistic case is also real. The Com's defining characteristic — the quality that makes it genuinely difficult to neutralize — is its structural looseness. There's no central server to seize, no hierarchy to decapitate, no single administrator whose arrest collapses the organization. It lives in the distributed topology of the modern internet: Telegram, Discord, Matrix, obscure forums, invite-only chats. Removing 4,340 URLs doesn't address the social graph underneath. The relationships persist. The knowledge transfers.
What changes is the friction. New members can't find the community as easily. Marginal participants drift away. The core that remains is more committed and harder to surveil — a classic radicalization funnel dynamic that counterterrorism analysts know well from studying other decentralized movements.
## The Violent Extremism Designation Has Teeth
Calling The Com a violent extremist network isn't just rhetorical. It has legal and operational consequences that the cybercrime framing doesn't.
In EU member states, violent extremism classifications unlock different investigative powers, different information-sharing frameworks with domestic intelligence services, and different cooperation mechanisms with platforms. Social media companies face greater legal pressure to respond quickly to extremism-flagged content than to generic cybercrime referrals. The Internet Referral Unit at Europol — which coordinates these URL removal requests — was built for counter-terrorism work. Routing The Com through that infrastructure signals that European authorities view this as closer to domestic terrorism than to financial crime.
That's a meaningful shift. Whether it's tactically correct is a different question. Treating nihilistic online communities as violent extremist movements risks importing the playbook failures of counterterrorism — surveillance overreach, radicalization-through-prosecution, and a tendency to harden committed members while failing to address the structural conditions that produce them. But the classification reflects an honest reading of the violence that has actually occurred.
## What Defenders Can Actually Do With This
The operational security implications for organizations are different than what most coverage emphasizes.
The threat The Com poses to enterprises isn't primarily about the URLs Europol just flagged. It's about the social engineering sophistication that these networks develop and export. The techniques that Scattered Spider used against MGM — voice phishing, MFA fatigue attacks, help desk impersonation — spread through these communities like open-source code. A teenager who spent three years in The Com's adjacent circles knows how to bypass identity verification systems that cost Fortune 500 companies millions to implement.
For defenders, the relevant mitigations are:
The URL removals don't change any of this calculus directly. But the increased law enforcement pressure may accelerate the community's pivot toward more technical attacks as physical coordination becomes riskier — making the defensive posture above more, not less, urgent.
---
## HackWire Analysis
The story most coverage is missing here is the classification problem itself. Europol calling The Com violent extremists is accurate in the sense that violence has been documented. It's also a significant epistemological move — one that will shape how platforms, governments, and investigators respond to similar communities going forward.
The parallel that keeps surfacing: this resembles how authorities eventually classified accelerationist networks like Atomwaffen after years of treating them as fringe online weirdness. The warning signs were visible for years in both cases. By the time the violent extremism label arrived, the most committed members were already deep enough to be nearly immune to deradicalization through content removal alone.
What's genuinely different about The Com compared to ideologically motivated extremist movements is the transaction layer. Money, status, and access to criminal infrastructure drive participation more than any coherent ideology. That makes the community less ideologically stable but also more elastic — people enter and exit based on opportunity rather than belief. That's actually harder to disrupt through conventional counterterrorism approaches, which assume a belief system to target.
The 4,340 URLs are a trailing indicator. The real question is whether Europol and its partners have developed the social graph intelligence to understand who the core community of practice is — the people who would still be coordinating if every flagged URL disappeared tomorrow. If the answer is yes, this operation is the visible surface of something much more consequential. If the answer is no, they've done the digital equivalent of mowing the grass.
— HackWire Editorial
---
## Related Coverage