‘A very toxic culture': Hacking gangs recruiting and exploiting young Canadians

CTV News

15-06-2025

Cybercrime gangs are recruiting young men from English-speaking countries like Canada, the U.S. and the U.K. According to cybersecurity experts, the gangs are part of a larger hacking community known as 'The Com' that has been linked to major data breaches, sextortion, and corporate ransom payments worth millions of dollars.
'These attacks are conducted by 17, 20, 19-year-olds,' Ian Lin, director of research and development at cybersecurity firm Packetlabs, told CTVNews.ca from Calgary. 'I think researchers like us don't give them enough credit for what they're actually capable of doing.'
'Judges and law enforcement are finally catching up'
Cyberthreat intelligence firm Intel471 says individuals and groups within The have engaged 'in cybercriminal activities such as subscriber identity module (SIM) swapping, cryptocurrency theft, commissioning real-life violence, swatting and corporate intrusions.'
The RCMP warn that members of The Com are also manipulating children online to commit self-harm, torture animals and produce child sexual exploitation material.
'What's special about this group is that they're native English speakers who know our culture and know how we talk, know how to coerce us into doing things that we might not want to,' Lin said.
In May, U.S. officials announced the extradition of U.K. national Tyler Buchanan, 23, a reported member of Com-affiliated group Scattered Spider, which Packetlabs says is 'increasingly recruiting young Canadians to their team.'
'The reason why this proliferates is because they are receiving payouts,' Lin said. 'We see these young people able to defeat technologies that people have spent millions of millions of dollars of research and innovation and creating them.'
Allison Nixon is the chief research officer and co-owner of Unit 221B, a U.S. cybersecurity firm named after Sherlock Holmes' apartment. The company specializes in helping clients deal with problems originating from The Com.
Nixon recently helped unmask an alleged member from Canada who purportedly threatened her online. Connor Riley Moucka, 25, of Kitchener, Ont. is now awaiting extradition to the U.S. to face 20 criminal charges, including several counts of extortion, computer fraud and identity theft.
Nixon says she is aware of other current Canadian members but declined to offer examples.
'Judges and law enforcement are finally catching up to this and they're treating them like street gangs in the more recent cases,' she said. 'I generally don't talk specifics about any actor before they're arrested because I don't want to spoil the surprise for them.'
Connor Moucka Alexander Moucka
Connor Moucka, also known as Alexander Moucka, in a photo taken by RCMP surveillance on Oct. 21, 2024. (Source: Court documents)
'A very toxic culture'
Nixon says young people get into The Com to make quick money, to seek protection from other members, or to lash out after being victims themselves.
'Another reason why people join The Com is because they think it's cool,' she added. 'People may join the com seeking fame or infamy, which is really the same thing to them.'
In addition to cybercrime, members of The Com have been accused of non-financial sextortion through online games and platforms like Discord and Telegram.
'A lot of these people are not skilled enough to actually cause harm to companies: they can't hack, they don't know technology, but it's a lot easier to threaten girls,' Nixon explained.
Groups within The Com have also been accused of commissioning violence and provoking swatting incidents, which is when someone makes a false report of an emergency in order to create a law enforcement response and draw SWAT teams to a target's location.
'They have rivalries with each other and they'll carry out their internet rivalries with violence,' Nixon said. 'Sometimes they'll SWAT each other or try to hack each other's accounts, or they will pay money to send someone to the rival's houses and either throw a brick through the window or shoot at the house or try to burn the house down.'
Nixon likens The Com to 'pre-internet teenage street gangs.'
'Teenagers with nothing better to do, rough home life, they meet each other, they congregate, they form a critical mass, and they perpetrate money-making schemes and violence, and they're a negative impact on their local communities, right?' she said. 'The Com is the same phenomenon, but playing out on the internet.'
Nixon says members of The Com tend to boast of their stunts and criminal activity to boost their online notoriety.
'In The Com, the culture prioritizes clout and respect and how big are you compared to everybody else,' Nixon said. 'It's a very toxic culture. And within this culture, your respect, your clout. is tied to subjugation of others.'
'Young cyber criminals that are very highly skilled'
Members of The Com have proven to be particularly successful at social engineering, which is when attackers use psychological manipulation to have someone divulge sensitive information or perform an action that compromises security.
'As these criminal groups are getting more information on people, they're able to tailor make these phishing exploits, they can make them more precise and sound more legitimate,' former CSIS and Canadian forces intelligence officer Scott White told CTVNews.ca.
'If I were to call you and say, 'I'm with the Toronto Police Service, I know your name, I know your telephone number, I know where you live, I've been able to get that information, are you still living at this residence?' All of a sudden, you're entering into a conversation with someone who you perceive to be legitimate.'
White is currently an associate professor and the director of the cybersecurity program at The George Washington University's college of professional studies in Washington, D.C.
'Anxiety is often the big motivator there, people are frightened into giving up information to someone else,' White said. 'You're dealing with young cyber criminals that are very highly skilled both in the technical component and social engineering.'