Hackers made death threats against this security researcher. Big mistake.

Welcome to MIT Technology Review Narrated. My name is Matt Honan. I'm our Editor-in-Chief. Every week, we'll bring you a fascinating, new, in-depth story from the leading edge of science and technology, covering topics like AI, biotech, climate, energy, robotics, and more. Here's this week's story. I hope you enjoy it. Kim Zetter writes, Hackers made death threats against this security researcher. Big mistake. In April 2024, a mysterious someone using the online handles Waifu and Yudisha began posting death threats on Telegram and Discord channels aimed at a cybersecurity researcher named Alison Nixon. Allison Nixon is going to get necklaced with a tire filled with gasoline soon, wrote waifu slash yudisha, both of which are words with offensive connotations. Decerebration is my fave type of brain death. That's what's going to happen to Allison Nixon. It wasn't long before others piled on. Someone shared AI-generated nudes of Nixon. These anonymous personas targeted Nixon because she had become a formidable threat. As chief research officer at the cyber investigations firm Unit 221B, named after Sherlock Holmes' apartment, she had built a career tracking cyber criminals and helping get them arrested. For years, she had lurked quietly in online chat channels or used pseudonyms to engage with perpetrators directly while piecing together clues they'd carelessly drop about themselves and their crimes. This had helped her bring to justice a number of cybercriminals, especially members of a loosely affiliated subculture of anarchic hackers who call themselves the COMM. But members of the COMM aren't just involved in hacking. Some of them also engage in offline violence against researchers who track them. This includes bricking, throwing a brick through a victim's window, and swatting, a dangerous type of hoax that involves reporting a false murder or hostage situation at someone's home, so SWAT teams will swarm it with guns drawn. Members of a COMM offshoot known as 764 have been accused of even more violent acts, including animal torture, stabbings, and school shootings, or of inciting others in and outside the comm to commit these crimes. Nixon started tracking members of the community more than a decade ago, when other researchers and people in law enforcement were largely ignoring them because they were young, many in their teens. Her early attention allowed her to develop strategies for unmasking them. Ryan Brogan, a special agent with the FBI, says Nixon has helped him and colleagues identify and arrest more than two dozen members of the community since 2011, when he first began working with her, and that her skills in exposing them are unparalleled. If you get on Allison's and my radar, you're going down. It's just a matter of time, he says. No matter how much digital anonymity and tradecraft you try to apply, you're done. Though she'd done this work for more than a decade, Nixon couldn't understand why the person behind the waifu yudisha accounts was suddenly threatening her. She had given media interviews about the comm, most recently on 60 Minutes, but not about her work unmasking members to get them arrested, so the hostility seemed to come out of the blue. And although she had taken an interest in the waifu persona in years past for crimes he boasted about committing, he hadn't been on her radar for a while. when the threats began, because she was tracking other targets. Now, Nixon resolved to unmask waifu, Yodisha, and others responsible for the death threats and take them down for crimes they admitted to committing. Prior to them death-threatening me, I had no reason to pay attention to them, she says. Most people have never heard of the calm, but its influence and threat are growing. It's an online community comprising loosely affiliated groups of primarily teens and 20-something in North America and English-speaking parts of Europe who have become part of what some call a cybercrime youth movement. Over the last decade, its criminal activities have escalated from simple distributed denial-of-service, DDoS attacks, that disrupt websites, to SIM-swapping hacks that hijack a victim's phone service, as well as crypto theft, ransomware attacks, and corporate data theft. These crimes have affected AT&T, Microsoft, Uber, and others. COMM members have also been involved in various forms of sextortion, aimed at forcing victims to physically harm themselves or record themselves doing sexually explicit activities. The COMM's impact has also spread beyond the digital realm to kidnapping, beatings, and other violence. One longtime cybercrime researcher, who asked to remain anonymous because of his work, says the calm is as big a threat in the cyber realm as Russia and China, for one unusual reason. There's only so far that China is willing to go. There's only so far that Russia or North Korea is willing to go, he says, referring to international laws and norms and fears of retaliation that prevent states from going all out in cyber operations. That doesn't stop the anarchic calm, he says. It's a pretty significant threat, and people tend to push it under the rug because it's just a bunch of kids, he says. But look at the impact they have. Brogan says the amount of damage they do in terms of monetary losses can become staggering very quickly. There is no single site where calm members congregate. They spread across a number of web forums and Telegram and Discord channels. The group follows a long line of hacking and subculture communities that emerged online over the last two decades, gained notoriety, and then faded or vanished after prominent members were arrested or other factors caused their decline. They differed in motivation and activity, but all emerged from the same primordial soup, says Nixon. The comms' roots can be traced to the scene, which began as a community of various WARS groups engaged in pirating computer games, music, and movies. When Nixon began looking at the scene in 2011, its members were hijacking gaming accounts, launching DDoS attacks, and running booter services. DDoS attacks overwhelm a server or computer with traffic from bot-controlled machines, preventing legitimate traffic from getting through. Booters are tools that anyone can rent to launch a DDoS attack against a target of choice. While they made some money, their primary goal was notoriety. This changed around 2018. Cryptocurrency values were rising, and the COM, or the community as it sometimes called itself emerged as a subgroup that ultimately took over the scene Members began to focus on financial gain cryptocurrency theft data theft and extortion The pandemic two years later saw a surge in comm membership that Nixon attributes to social isolation and the forced movement of kids online for schooling. But she believes economic conditions and socialization problems have also driven its growth. Many COMM members can't get jobs because they lack skills or have behavioral issues, she says. A number who have been arrested have had troubled home lives and difficulty adapting to school, and some have shown signs of mental illness. The COMM provides camaraderie, support, and an outlet for personal frustrations. Since 2018, it has also offered some a solution to their money problems. Loose-knit cells have sprouted from the community. — star fraud, shiny hunters, scattered spider, lapis— to collaborate on clusters of crime. They usually target high-profile crypto bros and tech giants and have made millions of dollars from theft and extortion, according to court records. But dominance, power, and bragging rights are still motivators, even in profit operations, says the cybercrime researcher, which is partly why members target big whales. There is financial gain, he says, but it's also sending a message that I can reach out and touch the people that think they're untouchable. In fact, Nixon says, some members of the calm have overwhelming ego-driven motivations that end up conflicting with their financial motives. Often, their financial schemes fall apart because of their ego, and that phenomenon is also what I've made my career on, she says. Nixon has straight dark hair, wears wire-rimmed glasses, and has a slight build and bookish demeanor that, on first impression, could allow her to pass for a teen herself. She talks about her work in rapid cadences, like someone whose brain is filled with facts that are under pressure to get out, and she exudes a sense of urgency as she tries to make people understand the threat the comm poses. She doesn't suppress her happiness when someone she's been tracking gets arrested. In 2011, when she first began investigating the communities from which the comm emerged, she was working the night shift in the security operations center of the security firm SecureWorks. The center responded to tickets and security alerts emanating from customer networks, but Nixon coveted a position on the company's counter-threats team, which investigated and published threat intelligence reports on mostly state-sponsored hacking groups from China and Russia. Without connections or experience, she had no path to investigative work. But Nixon is an intensely curious person, and this created its own path. Where the threat team focused on the impact hackers had on customer networks, how they broke in, what they stole, Nixon was more interested in their motivations and the personality traits that drove their actions. She assumed there must be online forums where criminal hackers congregated, So she googled Hacking Forums and landed on a site called Hack Forums. It was really stupid simple, she says. She was surprised to see members openly discussing their crimes there. She reached out to someone on the SecureWorks threat team to see if he was aware of the site, and he dismissed it as a place for script kiddies, a pejorative term for unskilled hackers. This was a time when many cybersecurity pros were shifting their focus away from cybercrime to state-sponsored hacking operations, which were more sophisticated and getting a lot of attention. But Nixon likes to zig where others zag, and her colleagues' dismissiveness fueled her interest in the forums. Two other SecureWorks colleagues shared that interest, and the three studied the forums during downtime on their shifts. They focused on trying to identify the people running DDoS booters. What Nixon loved about the forums was how accessible they were to a beginner like herself. Threat intelligence teams require privileged access to a victim's network to investigate breaches. But Nixon could access everything she needed in the public forums, where the hackers seemed to think no one was watching. Because of this, they often made mistakes in operational security, or OPSEC. letting slip little biographical facts such as the city where they lived, a school they attended, or a place they used to work. These details revealed in their chats, combined with other information, could help expose the real identities behind their anonymous masks. It was a shock to me that it was relatively easy to figure out who they were, she says. She wasn't bothered by the immature boasting and the petty fights that dominated the forums. A lot of people don't like to do this work of reading chat logs. I realize that this is a very uncommon thing, and maybe my brain is built a little weird that I'm willing to do this, she says. I have a special talent that I can wade through garbage, and it doesn't bother me. Nixon soon realized that not all the members were script kiddies. Some exhibited real ingenuity and powerful skills, she says. But because they were applying these to frivolous purposes, hijacking gamer accounts instead of draining bank accounts, researchers and law enforcement were ignoring them. Nixon began tracking them, suspecting that they would eventually direct their skills at more significant targets, an intuition that proved to be correct. And when they did, she had already amassed a wealth of information about them. She continued her DDoS research for two years until a turning point in 2013, when the cybersecurity journalist Brian Krebs, who made a career tracking cybercriminals, got swatted. About a dozen people from the security community worked with Krebs to expose the perpetrator, and Nixon was invited to help. Krebs sent her pieces of the puzzle to investigate, and eventually the group identified the culprit, though it would take two years for him to be arrested. When she was invited to dinner with Krebs and the other investigators, she realized she'd found her people. It was an amazing moment for me, she says. I was like, wow, there's all these like-minded people that just want to help and are doing it just for the love of the game, basically. It was porn stars who provided Nixon with her next big research focus, one that underscored her skill at spotting calm actors and criminal trends in their nascent stages before they emerged as major threats. In 2018, someone was hijacking the social media accounts of certain adult film stars and using those accounts to blast out crypto scams to their large follower bases. Nixon couldn't figure out how the hackers had hijacked the social media profiles, but she promised to help the actors regain access to their accounts if they agreed to show her the private messages the hackers had sent or received during the time they controlled them. These messages led her to a forum where members were talking about how they stole the accounts. The hackers had tricked some of these actors into disclosing the mobile phone numbers of others Then they used a technique called SIM swapping to reset passwords for social media accounts belonging to those other stars blocking them out In SIM swapping, fraudsters get a victim's phone number assigned to a SIM card and phone they control so that calls and messages intended for the victim go to them instead. This includes one-time security codes that cites text to account holders to verify themselves when accessing their account or changing its password. In some of the cases involving porn stars, the hackers had manipulated telecom workers into making the SIM swaps for what they thought were legitimate reasons, and in other cases, they bribed the workers to make the change. The hackers were then able to alter the password on the actor's social media accounts, lock out the owners, and use the accounts to advertise their crypto scams. SIM swapping is a powerful technique that can be used to hijack and drain entire cryptocurrency and bank accounts. So Nixon was surprised to see the fraudsters using it for relatively unprofitable schemes. But sim swapping had rarely been used for financial fraud at that point, and like the earlier hackers Nixon had seen on hack forums, the ones hijacking porn star accounts didn't seem to grasp the power of the technique they were using. Nixon suspected that this would change, and sim swapping would soon become a major problem. so she shifted her research focus accordingly. It didn't take long for the fraudsters to pivot as well. Nixon's skill at looking ahead in this way has served her throughout her career. On multiple occasions, a hacker or hacking group would catch her attention for using a novel hacking approach in some minor operation, for example, and she'd begin tracking their online posts and chats in the belief that they'd eventually do something significant with that skill. They usually did. When they later grabbed headlines with a showy or impactful operation, these hackers would seem to others to have emerged from nowhere, sending researchers and law enforcement scrambling to understand who they were. But Nixon would already have a dossier compiled on them and, in some cases, had unmasked their real identity as well. Lizard Squad was an example of this. The group burst into the headlines in 2014 and 2015 with a series of high-profile DDoS campaigns. But Nixon and her colleagues at the job where she worked at the time had already been watching its members as individuals for a while. So the FBI sought their assistance in identifying them. The thing about these young hackers is that they keep going until they get arrested. But it takes years for them to get arrested, she says. So a huge aspect of my career is just sitting on this information that has not been actioned yet. It was during the Lizard Squad years that Nixon began developing tools to scrape and record hacker communications online, though it would be years before she began using these concepts to scrape the comm chat rooms and forums. These channels held a wealth of data that might not seem useful during the nascent stage of a hacker's career, but could prove critical later when law enforcement got around to investigating them. Yet the contents were always at risk of being deleted by comm members or getting taken down by law enforcement when it seized websites and chat channels. Over several years, she scraped and preserved whatever chat rooms she was investigating. But it wasn't until early 2020, when she joined Unit 221B, that she got the chance to scrape the telegram and Discord channels of the comm. She pulled all of this data together into a searchable platform that other researchers and law enforcement could use. The company hired two former hackers to help build scraping tools and infrastructure for this work. The result is eWitness, a community-driven, invitation-only platform. It was initially seeded only with data Nixon had collected after she arrived at Unit 221B, but has since been augmented with data that other users of the platform have scraped from comms social spaces as well, some of which doesn't exist in public forums anymore. Brogan of the FBI says it's an incredibly valuable tool, made more so by Nixon's own contributions. Other security firms scrape online criminal spaces as well, but they seldom share the content with outsiders, and Brogan says Nixon's work is unique because she engages with the actors in chat spaces to draw out information from them that would not be otherwise normally available. The preservation project she started when she got to Unit 221B could not have been better timed because it coincided with the pandemic, the surge in new COM membership, and the emergence of two disturbing COM offshoots, CVLT and 764. She was able to capture their chats as these groups first emerged. After law enforcement arrested leaders of the groups and took control of the servers where their chats were posted, this material went offline. Colt was reportedly founded around 2019, with a focus on sextortion and child sexual abuse material. 764 emerged from cult and was spearheaded by a 15-year-old in Texas named Bradley Cadenhead, who named it after the first digits of a zip code. Its focus was extremism and violence. In 2021, because of what she observed in these groups, Nixon turned her attention to sextortion among comm members. The type of sextortion they engaged in has its roots in activity that began a decade ago as fan signing. Hackers would use the threat of doxing to coerce someone, usually a young female, into writing the hacker's handle on a piece of paper. The hacker would use a photo of it as an avatar on his online accounts, a kind of trophy. Eventually, some began blackmailing victims into writing the hacker's handle on their face, breasts, or genitals. With cult, this escalated even further. Targets were blackmailed into carving a comm member's name into their skin or engaging in sexually explicit acts while recording or live-streaming themselves. During the pandemic, a surprising number of SIM swappers crossed into child sexual abuse material and sadistic sextortion, according to Nixon. She hates tracking this gruesome activity, but she saw an opportunity to exploit it for good. She had long been frustrated at how leniently judges treated financial fraudsters because of their crime's seemingly nonviolent nature. But she saw a chance to get harsher sentences for them if she could tie them to their sextortion and began to focus on these crimes. At this point, waifu still wasn't on her radar, but that was about to change. Nixon landed in waifu's crosshairs after he and fellow members of the COMM were involved in a large hack involving AT&T customer call records in April 2024. Waifu's group gained access to dozens of cloud accounts with Snowflake, a company that provides online data storage for customers. One of those customers had more than 50 billion call logs of AT&T wireless subscribers stored in its Snowflake account. Among the subscriber records were call logs for FBI agents who were AT customers Nixon and other researchers believe the hackers may have been able to identify the phone numbers of agents through other means Then they may have used a reverse lookup program to identify the owners of phone numbers that the agents called, or that called them, and found Nixon's number among them. This is when they began harassing her. But then they got reckless. They allegedly extorted nearly $400,000 from AT&T in exchange for promising to delete the call records they'd stolen. Then they tried to re-extort the telecom, threatening on social media to leak the records they claimed to have deleted if it didn't pay more. They tagged the FBI in the post. It's like they were begging to be investigated, says Nixon. The snowflake breaches and AT&T records theft were grabbing headlines at the time, but Nixon had no idea her number was in the stolen logs or that Waifu Yudisho was a prime suspect in the breaches. So she was perplexed when he started taunting and threatening her online. Over several weeks in May and June 2024, a pattern developed. Waifu or one of his associates would post a threat against her and then post a message online inviting her to talk. She assumes now that they believed she was helping law enforcement investigate the snowflake breaches and hoped to draw her into a dialogue to extract information from her about what authorities knew. But Nixon wasn't helping the FBI investigate them yet. It was only after she began looking at Waifu for the threats that she became aware of his suspected role in the snowflake hack. It wasn't the first time she had studied him, though. Waifu had come to her attention in 2019 when he bragged about framing another comm member for a hoax bomb threat and later talked about his involvement in sim-swapping operations. He made an impression on her. He clearly had technical skills, but Nixon says he also often appeared immature, impulsive, and emotionally unstable, and he was desperate for attention in his interactions with other members. He bragged about not needing sleep and using Adderall to hack through the night. He was also a bit reckless about protecting personal details. He wrote in private chats to another researcher that he would never get caught because he was good at OPSEC, but he also told the researcher that he lived in Canada, which turned out to be true. Nixon's process for unmasking waifu followed a general recipe she used to unmask comm members. She'd draw a large investigative circle around a target and all the personas that communicated with that person online. and then study their interactions to narrow the circle to the people with the most significant connections to the target. Some of the best leads came from a target's enemies. She could glean a lot of information about their identity, personality, and activities from what the people they fought with online said about them. The enemies and the ex-girlfriends, generally speaking, are the best for gathering intelligence on a suspect, she says. I love them. While she was doing this, Waifu and his group were reaching out to other security researchers, trying to glean information about Nixon and what she might be investigating. They also attempted to plant false clues with the researchers by dropping the names of other cybercriminals in Canada who could plausibly be Waifu. Nixon had never seen cybercriminals engage in counterintelligence tactics like this. Amid this subterfuge and confusion, Nixon and another researcher working with her did a lot of consulting and cross-checking with other researchers about the clues they were gathering to ensure that they had the right name before they gave it to the FBI. By July 2024, she and the researcher were convinced they had their guy, Connor Riley Mochka, a 25-year-old high school dropout living with his grandfather in Ontario. On October 30, 2024, Royal Canadian Mounted Police converged on Mochka's home and arrested him. According to an affidavit filed in Canadian court, a plainclothes Canadian police officer visited Mochka's house under some pretense on the afternoon of October 21, nine days before the arrest, to secretly capture a photo of him and compare it with an image U.S. authorities had provided. The officer knocked and rang the bell. Mochka opened the door, looking disheveled, and told the visitor, You woke me up, sir! He told the officer his name was Alex. Mochka sometimes used the alias Alexander Antonin Mochka. Satisfied that the person who answered the door was the person the U.S. was seeking, the officer left. Waifu's online rants against Nixon escalated at this point, as did his attempts at misdirection. She believes the visit to his door spooked him. Nixon won't say exactly how they unmasked Mochka, only that he made a mistake. I don't want to train these people in how to not get caught by revealing his error, she says. The Canadian affidavit against Mochka reveals a number of other violent posts he's alleged to have made online beyond the threats he made against her. Some involve musings about becoming a serial killer or mass mailing sodium nitrate pills to black people in Michigan and Ohio. In another, his online persona talks about obtaining firearms to kill Canadians and commit suicide by cop. Prosecutors who list Mochka's online aliases as including waifu, yudisha, and two more in the indictment, say he and others extorted at least $2.5 million from at least three victims whose data they stole from Snowflake accounts. Mochka has been charged with nearly two dozen counts, including conspiracy, unauthorized access to computers, extortion, and wire fraud. He has pleaded not guilty and was extradited to the U.S. in July 2025. His trial is scheduled for October 2026, though hacking cases usually end in plea agreements rather than going to trial. It took months for authorities to arrest Mochka after Nixon and her colleagues shared their findings with the authorities, but an alleged associate of his in the Snowflake conspiracy, a U.S. Army soldier named Cameron John Wagenius, Kyber Phantom Online, was arrested more quickly. On November 10, 2024, Nixon and her team found a mistake Wagenius made that helped identify him, and on December 20, he was arrested. Wagenius has already pleaded guilty to two charges around the sale or attempted sale of confidential phone records and will be sentenced in March 2026. These days, Nixon continues to investigate sextortion among comm members, but she says that remaining members of Waifu's group still taunt and threaten her. They are continuing to persist in their nonsense, and they are getting taken out one by one, she says, and I'm just going to keep doing that until there's no one left on that side. You are listening to MIT Technology Review, where Kim Zetter writes, Hackers made death threats against this security researcher. Big mistake. This article was published on the 16th of February, 2026, and was read by Adrian Walker for NOAA.