A 19-year-old man from San Antonio pleaded guilty Friday to multiple crimes involving the sexual exploitation of children while acting as an administrator and leader of 8884, a splinter group of the violent extremist collective known as 764. 

Alexis Aldair Chavez faces up to 60 years in prison for racketeering, distribution and possession of child sexual abuse material (CSAM). He was arrested and has been detained without bail since October 2024.

Chavez began associating with 764 as a minor in 2022 when a co-conspirator introduced him to 7997, one of many 764 offshoots affiliated with The Com. Authorities describe The Com as a sprawling nihilistic violent extremist network of thousands of people, typically between 11 and 25 years old, engaged in a growing online threat to coerce vulnerable children to produce CSAM of themselves, gore material, self mutilation, sibling abuse, animal abuse and other acts of violence.

“Chavez led a group of online predators whose ultimate purpose is to destroy our society,” Sue Bai, principal deputy assistant attorney general for national security, said in a statement. “They tried to achieve that heinous goal by desensitizing innocent children to violence — coercing them to perform gruesome and harmful acts against themselves and animals — with the hope of encouraging further violence and spreading chaos.”

Prosecutors said Chavez “earned the right” to participate in 7997 chat rooms by killing his cat and posting a video of the crime for others to view. He later groomed multiple victims to blackmail and coerce additional victims, all to increase reputation within the group’s ranks, according to federal court records.

Chavez attempted to coerce a girl to commit suicide and blackmailed another girl into self-mutiliation, animal torture and illicit content production in late 2023. He later worked with multiple co-conspirators and blackmailed some of his victims to coerce other girls to degrade themselves on camera and produce CSAM.

The indictment filed against Chavez in the U.S. District Court for the Western District of Texas details a series of horrifying crimes he committed with co-conspirators and some of his victims. 

Separately, Chavez coerced multiple minors to harm themselves or engage in various acts of depravity on video chats in the 8884 channel.

“The depraved acts described in the indictment are very normal for these people,” Allison Nixon, chief research officer at Unit 221B, told CyberScoop. 

Nixon, who has studied domestic and English-speaking cybercrime and tracked its rise for more than a decade, said 764 is a “very important tar pit for certain rare, risky personalities” that is likely worthy of scientific study. 

“8884 and 7997 are part of a homogenous 764 copycat soup. All of these groups start to blend together,” she said. “Most of these actors are motivated by attention seeking, and their culture is based on competing to be the worst. Ironically, they all end up being the same.”

When the FBI executed a search warrant at Chavez’s residence in July 2024, prosecutors said he came out the backdoor and threw his phone over a neighbor’s fence in an attempt to hide evidence.

Chavez’s guilty plea follows a year of heightened law enforcement activity, which has netted arrests of multiple alleged 764 leaders and members.

Two alleged leaders of 764, Leonidas Varagiannis and Prasan Nepal, were arrested and charged for directing and distributing CSAM in April. The two men are accused of exploiting at least eight minor victims, some as young as 13 years old, and face charges that carry a maximum penalty of life in prison.

Baron Cain Martin, of Tucson, Arizona, allegedly joined the child sextortion ring as early as 2019, eventually acting as a leader until his arrest late last year. Martin faces 29 charges and, if convicted, up to life in prison.

Tony Christopher Long, of California, pleaded not guilty last month to multiple charges carrying a maximum penalty up to 69 years in prison related to his alleged involvement in the nihilistic violent extremist group. 

Erik Lee Madison, of Maryland, was arrested in November and is accused of victimizing at least five children this fall, including one as young as 13 at the time. His alleged criminality dates back to 2020 when he was a minor.

“All of the 764 cases I’ve seen presented by law enforcement have been high quality and successful, and I hope this work can continue,” Nixon said.

Chavez’s sentencing is set for March 25, 2026. You can read the full indictment below.

The post Leader of 764 offshoot pleads guilty, faces up to 60 years in jail appeared first on CyberScoop.

Federal prosecutors allege that three cybersecurity professionals, whose job was to help companies respond to ransomware attacks, instead carried out their own ransomware schemes against five U.S. businesses in 2023.

Ryan Clifford Goldberg, Kevin Tyler Martin and an unnamed co–conspirator — all U.S. nationals — began using ALPHV, also known as BlackCat, ransomware to attack companies in May 2023, according to indictments and other court documents in the U.S. District Court for the Southern District of Florida. 

At the time of the attacks, Goldberg was a manager of incident response at Sygnia, while Martin, a ransomware negotiator at DigitalMint, allegedly collaborated with Goldberg and another co-conspirator, who also worked at DigitalMint and allegedly obtained an affiliate account on ALPHV. 

The trio are accused of carrying out the conspiracy from May 2023 through April 2025, according to an affidavit. The Chicago Sun-Times was the first to report on the indictment.

Victims impacted by the attacks over a six-month period in 2023 included a medical company based in Florida, a pharmaceutical company based in Maryland, a California doctor’s office, an engineering company based in California and a drone manufacturer in Virginia. 

Goldberg, Martin and their co-conspirator received a nearly $1.3 million ransom payment from the medical company in May 2023, but did not successfully extort a financial payment from the other victims, prosecutors said. 

Sygnia confirmed Goldberg was formerly employed by the company. “Immediately upon learning of the situation, he was terminated,” the company said in a statement. 

Goldberg’s attorney declined to comment.

DigitalMint confirmed in a statement Monday that a former employee was indicted for organizing and participating in ransomware attacks. The company did not say when nor how it became aware of Martin and his co-worker’s alleged criminal activities, and did not describe the circumstances regarding the end of their employment.

“The charged conduct took place outside of DigitalMint’s infrastructure and systems. The co-conspirators did not access or compromise client data as part of the charged conduct,” the company said in a statement. “No one potentially involved in the charged scheme has worked at the company in over four months.”

ALPHV/BlackCat was a notorious ransomware and extortion group linked to a series of attacks on critical infrastructure providers. The ransomware variant first appeared in late 2021, and was later used in dozens of attacks on organizations in the health care sector. 

The group behind the ransomware strain also claimed responsibility for last year’s attack on UnitedHealth Group subsidiary Change Healthcare, which paid a $22 million ransom and became the largest health care data breach on record, compromising data on about 190 million people. 

Goldberg and Martin were both indicted Oct. 2 for conspiring to interfere with commerce by extortion, interference with commerce by extortion, and intentional damage to a protected computer. 

Martin was arrested Oct. 14 and freed on a $400,000 bond Oct. 24. He pleaded not guilty and is prohibited from working in cybersecurity awaiting trial. Martin’s attorney did not immediately respond to a request for comment.

Goldberg was arrested Sept. 22 and ordered to remain in custody pending trial due to flight risk. Goldberg and his wife boarded a one-way flight to Paris from Atlanta on June 27 and remained in Europe until Sept. 21. When Goldberg flew directly from Amsterdam to Mexico City, he was arrested upon landing and deported to the United States.

Court records show Goldberg allegedly confessed he was recruited by the unnamed co-conspirator to “try and ransom some companies” during an interview with the FBI June 17. The FBI seized his devices that day.

According to authorities, Goldberg allegedly admitted that he conducted the attacks to get out of debt. He also allegedly told FBI agents that he and his two accomplices successfully extorted a ransom payment from the medical company, which earned him a $200,000 share.

Martin and Goldberg each face a maximum penalty up to 50 years in federal prison.

You can read the full indictment below.

The post Prosecutors allege incident response pros used ALPHV/BlackCat to commit string of ransomware attacks appeared first on CyberScoop.

Federal law enforcement said a leader of 764, a violent extremist group, has been in federal custody since he was arrested in December and faces 29 charges for running a loose-knit collective involved in child exploitation, cyberstalking, kidnapping, animal torture, wire fraud and murder.

Baron Cain Martin, 21, of Tucson, Arizona, allegedly joined the child sextortion ring as early as 2019, eventually acting as a leader until his arrest late last year, according to an indictment unsealed Thursday in the U.S. District Court for the District of Arizona.

Martin is charged with providing material support to terrorists, producing and distributing child sexual abuse material (CSAM), coercing minors to engage in sexual activity, cyberstalking, animal crushing and conspiracy to commit wire fraud. He faces up to life in prison, many times over.

“This man’s alleged crimes are unthinkably depraved and reflect the horrific danger of 764 — if convicted, he will face severe consequences as we work to dismantle this evil network,” Attorney General Pamela Bondi said in a statement. “I urge parents to remain vigilant about the threats their children face online.”

Martin’s arrest and indictment comes amid a flurry of law enforcement activity targeting 764 and its alleged members.

Federal authorities announced Martin’s arrest and unsealed charges filed against him shortly after another alleged 764 member, Tony Christopher Long, a 19-year-old California man, pleaded not guilty to multiple charges carrying a maximum penalty up to 69 years in prison related to his alleged involvement in the nihilistic violent extremist group.

Two alleged leaders of 764 were arrested and charged for directing and distributing CSAM in April. The two men, Leonidas Varagiannis and Prasan Nepal, are accused of exploiting at least eight minor victims, some as young as 13 years old, and face charges that carry a maximum penalty of life in prison.

“Law enforcement is dogpiling these people and I think that’s great,” Allison Nixon, chief research officer at Unit221B, told CyberScoop.

“They don’t stop until they are physically ripped off the computer,” she said. “The enormous amount of charges isn’t surprising.”

764 is an offshoot of The Com, a global collective of loosely associated groups spanning thousands of people, typically between 11 and 25 years old, that commit financially motivated, sexual and violent crimes. The FBI previously said members of 764 and related groups are driven by a range of personal motives, including notoriety, sexual gratification or a sense of belonging. 

“[Martin’s] actions as a leader of this criminal network were so atrocious and extreme that he is charged with supporting terrorism,” FBI Director Kash Patel said in a statement. “It’s alleged that Martin not only committed these crimes but wrote and posted a guide for others to use to identify, groom, and extort their own victims.”

Nixon, who has tracked the rise of English-speaking cybercrime for more than a decade, said she found the grooming guide Martin allegedly produced and distributed online. The guide included details about how to identify, groom and extort vulnerable children and advised readers to target victims struggling with mental health, officials said.

Other federal law enforcement officials described Martin’s alleged crimes as “so depraved they defy comprehension,” “an assault on the basic foundations of human decency,” and “promoting some of the sickest forms of human depravity.”

Martin, also known by the online moniker “Convict” among many others, allegedly provided assistance as personnel, service and expert advice to carry out a conspiracy to kill or main a person in a foreign country, according to authorities. He is also accused of conspiring with others to coerce a victim living outside the United States to self-harm, self-main and self-kill, officials said. 

“He was respected in these communities because of his acts and was influential,” Nixon said. “I would agree he was a leader, and his friends will be reading his court documents with admiration.”

Martin is charged with five counts of producing CSAM, 11 counts of distributing CSAM and three counts of coercing minors to engage in sexual activity. He is accused of victimizing at least nine victims, eight of which were between the ages of 11 and 15 years old at the time.

“The FBI will not stop until we find those who perpetrate these horrific crimes that prey on the most vulnerable members of our communities,” Patel said.

You can read the full indictment below.

The post Alleged 764 leader arrested in Arizona, faces life in prison appeared first on CyberScoop.