12 November 2025

Content Warning: This Dispatch contains materials related to sexual violence, physical abuse, and psychological abuse. 

---

The 764 network has become notorious for its brutal and exploitative targeting of minors, whom it coerces into producing violent self-harm content and child sexual abuse material (CSAM). Recently, particularly in the United States, the group has increasingly shifted toward real-world violence more akin to other communities within the nihilistic-violence milieu—where perpetrators commit violent acts without ideological motivation, driven instead by a misanthropic worldview. 

This Dispatch examines three US cases linked to 764—a stabbing, a series of arsons, and a foiled mass-shooting plot—which together suggest a significant shift in the network’s operations in 2025. It also explores possible reasons for this change, including a shift in internal leadership that may have led to violence—rather than CSAM creation—becoming the new entry requirement for members. This evolution underscores the need for coordinated prevention and intervention strategies that bring together law enforcement, educators and community actors. 

Introduction 

On 27 July, a 20-year-old Wisconsin man phoned local authorities and said he had stabbed a homeless woman.  

According to court documents, when officers arrived, they found the suspect next to the badly wounded victim, who was suffering from multiple stab wounds. Law enforcement stated the suspect told them he had left his home with a knife earlier that night, intending to find someone to kill.  

The suspect allegedly encountered the victim on a park bench, struck up a conversation, and lured her into a nearby park. There, he told her he was “going to kill her” before repeatedly stabbing her. Afterwards, while being interviewed by law enforcement, the suspect reportedly said since the age of 10 he had “thought about killing people” but “never had the right opportunity to do it.” He reportedly laughed when telling the story and when he was informed that she would survive, he became agitated. 

ISD research indicates the man was a member of an online group associated with the 764  sextortion network, where he was known under the alias “Corrupt.” His case is the latest in a series of incidents tied to the network, whose affiliates have increasingly been accused of violent attacks and plots—a departure from the online sextortion and child sexual abuse material (CSAM) production for which 764 is best known. 

Europe-based groups in the 764 network have historically glorified real-world violence, and individuals associated with these groups have carried out at least three stabbing sprees in the last three years. Until recently, however, no US-based members were known to have engaged in mass public targeted violence. That changed this year, and since then at least four violent incidents have been linked to the network: a disrupted mall attack plot in Oregon on 22 May, an arson spree in Wisconsin on 7 June, a stabbing in Minnesota on 27 July, and a stabbing in California on 9 August. 

Together, these cases suggest that US-based components of the 764 network—long associated with sextortion—may be adopting the violent, on-the-ground tactics seen in other nihilistic violence communities as new pathways into the network’s inner circle. It marks a critical evolution in how 764 operates, expanding their targets from vulnerable online youth to the broader public.  

Background  

The 764 network is a loosely connected, transnational set of online groups that engage in sextortion and the glorification of violence.  

The network comprises a constantly shifting landscape of splinter groups and offshoots and operates across many platforms, including Discord, Telegram and Roblox. It is known to coerce minors into producing CSAM. The users then use CSAM as leverage to force victims to perform acts of violence, animal abuse or self-harm. 764 is part of a larger network known as the COM network which also includes communities focused on hacking and swatting. 

Between 2020 and 2025, 191 members of 764 (or members of affiliated groups) in 28 different countries have been arrested for sextortion, possession of CSAM, or violent attacks. Following the arrest of two high profile members, US Attorney General Pamela Bondi described the group as “one of the most heinous online child exploitation enterprises we have ever encountered — a network built on terror, abuse, and the deliberate targeting of children.”  

For participants, sadism and brutality are a form of currency corresponding to the member’s in-group status. This structure drives a constant process of one-upmanship through which a member’s advancement within the group’s hierarchy can only be accomplished through increased displays of sadism and violence. This internal social structure has likely influenced the network’s shift toward increased real-world violence.
 

Shift to violence 

The primary activities of US-based elements of the 764 network appear to be shifting from the production and distribution of CSAM to the glorification and commission of real-world violence. This marks a significant development for the group within the US.   

While this trend is new in the US, it mirrors patterns seen elsewhere. Members of 764 and affiliated nihilistic violence subcultures such as No Lives Matter (NLM) have previously been tied to acts of violence in Europe and South America, including two separate stabbing sprees in Sweden. Until 2025, however, no members had been prosecuted for violent plots in the US. 

The evolution of groups within the 764 network lies at the center of a broader, growing threat of nihilistic violence—violence devoid of ideological motivation and driven by a misanthropic worldview. This absence of clear ideology places such acts outside the parameters of existing prevention and counter-terrorism frameworks, which remain largely designed to identify and counter ideologically motivated threats. 

The shift toward nihilistic violence within the US-based 764 network has been illustrated by four recent arrests. In Oregon, a 14-year-old’s disrupted mass shooting plot in May showed how 764-affiliated spaces can exploit individuals already predisposed to violence. In Wisconsin, a 12-year-old’s arson spree in June —celebrated and claimed by a 764 offshoot—demonstrates how public acts of violence may have replaced CSAM creation as an entry requirement into the group. Finally, the July stabbing of a homeless Minnesota woman by a 20-year-old and the August stabbing of a restaurant worker, both allegedly carried out by individuals linked to 764 underscore the influence of other nihilistic-violence subcultures, which promote random, dehumanizing violence as proof of loyalty.  

Together, these arrests highlight several dimensions of this evolution: the role of leadership in shaping the network, the power vacuum created by recent arrests of key figures, and the adoption of random acts of violence as a new pathway to status and inclusion. 

Changing leadership, changing tactics

The 764 network has long been led by a small group of influential contributors who drive its nihilistic online subculture forward and encourage escalation among members. These figures hold an almost celebrity-like status within the community, shaping its goals and wielding significant influence over its direction. When such leaders are arrested or removed, they leave behind a power vacuum. 

On 29 April, the Justice Department announced charges against Leonidas Varagiannis (a.k.a. “War”) and Prasan Nepal (a.k.a. “Trippy”). These individuals operated a private channel within 764 known as Inferno, which coordinated and directed the production of CSAM. According to court documents, both Nepal and Varagiannis appeared primarily interested in the CSAM aspect of the network’s activities. Court filings suggest that Nepal and Varagiannis, alongside other prominent members, directly set the targets and priorities of the network. This indicates that the prevailing focus on sextortion may have emerged from this smaller, insular leadership group. Access to these spaces was reportedly restricted to those trafficking in the most extreme content. 

Rising to fill the power vacuum left by the arrest of Nepal and Varagiannis were younger “new-gen” members more interested in violence than sextortion. ISD assesses that this new leadership cohort, which includes prominent NLM-aligned figures, may be using their influence to bring the practices of nihilistic-violence subcultures into the US-based 764 network. 

Entry requirements circulated in 764-affiliated groups such as Suicide Hill—the group linked to the accused 12-year-old Wisconsin arsonist—no longer emphasize sextortion. Instead, they increasingly mirror those of subcultures like NLM, requiring acts of vandalism, arson or real-world violence. When sextortion is referenced, proof is often based on “cutsigns” (images or videos showing a victim carving the name of their abuser into their skin) rather than sexually explicit content, underscoring the growing primacy of violence over sextortion. 

The shift within the 764 network—from producing or disseminating graphic child sexual abuse material to engaging in acts of vandalism, arson and other forms of real-world violence—may be lowering the barrier to entry for potential participants. Offline acts require less social coordination than online exploitation and may appear to some as more accessible ways to gain status within the network. This, in turn, could expand its base of active members and deepen the overlap between communities such as NLM and 764. 

Case studies 

Foiled Oregon mall attack 

A 14-year-old from Columbia County, Oregon, was arrested on 22 May in connection with a plot to attack patrons at the Three Rivers Mall in Kelso, Washington. 

While Carr’s motivation remains unclear, the teenager participated in a 764-affiliated chatroom, where he was identified by an FBI source and accused of sharing his attack plans. Prosecutors noted an extensive history of suicidal and homicidal ideation. Law enforcement found materials in his residence indicating attack planning, including detailed maps of the mall and plans to construct a bomb. Carr is said to have had access to unsecured firearms in his family’s home. 

Without records from the chatroom in which Carr participated, it is difficult to determine what, if any, role 764 members played in encouraging or enabling him. It is likely, however, that they viewed Carr’s pre-existing desire to carry out violence as an opportunity to garner notoriety and publicity for the network. 

Wisconsin arsons 

On 12 June 12, a 764-affiliated group called Suicide Hill shared news footage of an incident in Kenosha, Wisconsin, in which a 12-year-old boy carried out three vehicle arsons within a six-day span in late May and early June. ISD analysts observed posts from the 764-affliated group Suicide Hill claiming credit for the arsons, indicating that one of their members was responsible. The channel added footage of the arsons to video montages—known as “edits”—intended to promote the group.  

Following the arsons, Suicide Hill propaganda circulated more widely across the COM network. These were used to attract publicity and new recruits. Based on observations from similar 764-linked groups, ISD assessed that Suicide Hill likely requires new recruits to submit video evidence of criminal or anti-social behavior before granting access to private chat groups. 

Minnesota stabbing 

On 27 July, 20-year-old Logan Anthony Seitz of Brooklyn Center, Minnesota, was arrested after calling 911 and allegedly claiming he stabbed an unhoused woman “about 20 times” and that he “enjoyed it.” As mentioned earlier, authorities reported that Seitz stated he had snuck out of his home with the intent to kill a random person, reportedly showed “no remorse” about his actions, and became agitated when he was told that the victim was expected to survive.  

According to posts reviewed by analysts, Seitz, who used the moniker “Corrupt,” was a member of the 764 offshoot SlitTown. The stabbing bears all the hallmarks of the nihilistic violence promoted by NLM and other similar groups. Manuals published by these groups instruct members to seek out targets who are less able to defend themselves, such as the elderly or those experiencing homelessness. Perpetrators are also encouraged to use knives or household tools to carry out these attacks, just as Seitz is said to have done. 
 

California stabbing 

On 24 August, Luis McLaughlin—a Newark, California, resident who ISD analysts assess is associated with NLM—was arrested for what media reports indicated was a random non-fatal stabbing of a restaurant worker. The stabbing was livestreamed on Discord on 19 August and subsequently shared within Telegram channels associated with the 764 network. Video of the incident has also been shared extensively online on websites and social media channels dedicated to gore and the glorification of nihilistic violence.  

Conclusion 

The recent arrests of 764 affiliates—or those found to be in connection—for stabbings, arsons and a foiled mass shooting point to a troubling trend: the network is increasingly pivoting toward real-world violence.  

Europe-based groups in the 764 network had focused more heavily on real-world violence while the remainder of the network remained dedicated to sextortion—a dichotomy that was reflected in the groups’ propaganda and the activities of their affiliates. The migration of these practices to the US indicates that subcultures of nihilistic violence focused on targeted mass violence are more culturally dominant than those engaged in sextortion, both in the US and abroad. 

Networks like 764 are amorphous and ever-shifting, making them especially difficult for law enforcement to combat. When one cell is dismantled, another emerges; when leaders are detained, new figures step forward. The removal of leaders like Nepal and Varagiannis earlier this summer marked significant progress, but it also created a power vacuum that others are eager to exploit.  

The 764 network and its associated subcultures of nihilistic violence operate largely outside the ideological frameworks that guide most law enforcement and prevention efforts. Their members are often young, socially isolated, and motivated by performative violence rather than traditional extremist ideologies. As the network’s activities shift from online offenses such as sextortion and swatting to offline acts like arson and stabbings, traditional law enforcement tools may prove insufficient for addressing this evolving threat landscape.  

The continued mutation of these communities underscores the need for a public health–based approach to prevention—a comprehensive, community-based model that addresses the underlying risk factors driving targeted violence, even when no clear extremist ideology is present. This requires greater cross-agency collaboration between law enforcement, educators and community actors to build resilience and reduce vulnerability to recruitment and mobilization.