English-Speaking Cybercriminal Network ‘The COM’ Drives Global Cyberattacks

The COM, described as an English-speaking cybercriminal ecosystem, has evolved from niche underground forums into a decentralised, service‑oriented economy that orchestrates large‑scale attacks against multinational corporations, government entities, critical infrastructure and retail investors. Key threat actors within The COM include Lapsus$, ShinyHunters, Scattered Spider (UNC3944) and the Silent Ransom Group, who operate with specialised roles and underground supply chains to monetise their capabilities.

The article notes that social engineering is the primary attack vector across this ecosystem, exemplified by OGUsers’ callers and Lapsus$ manipulation of IT staff, with SIM‑swapping used to bypass traditional 2FA protections. It also highlights a migration to encrypted messaging platforms like Telegram and Discord after law enforcement disruptions, and cites major forum takedowns such as RaidForums and BreachForums, which fractured but did not dismantle the network.

The COM today facilitates data breaches, extortion campaigns, SIM‑swapping, ransomware, cryptocurrency theft, rug pulls and financial fraud, driven by both financial gain and notoriety. To counter the threat, the piece urges organisations to adopt Zero Trust, strengthen employee security awareness, and migrate to phishing‑resistant MFA such as FIDO2/WebAuthn.