"The Com's content is laced with coded language and emojis that adults may struggle to decipher, conveying sinister messages that encourage self-harm and the sexual exploitation of minors," Europol said.
Referral Action Days: nine countries, 4,340 URLs flagged
Europol announced that investigators from nine countries — Belgium, Finland, Hungary, Ireland, Luxembourg, the Netherlands, Portugal, Spain, and Sweden — participated in multi-week "Referral Action Days" between June and July 2026. The operation, organized by Europol's EU Internet Referral Unit (EU IRU) and Spain's Intelligence Centre against Terrorism and Organised Crime (CITCO), resulted in 4,340 URLs being flagged for removal. Europol tied the joint action to the European Commission's ProtectEU counterterrorism agenda and said the operation aimed to disrupt The Com's online ecosystem, limit nihilistic violent extremism content disseminated online by The Com groups, and generate new investigative leads.
What investigators say was being removed
Europol described the material targeted in the operation as broad and explicitly harmful. The content referenced by investigators includes violent videos and images depicting self-harm, suicide, child sexual abuse material (CSAM), animal cruelty, and violent attacks. Other flagged items included videos of violent street attacks — a practice Europol named "manhunt" — and arson. Europol also highlighted manuals or guides produced by The Com that cover topics such as grooming, murder, improvised explosives, or ideological viewpoints, saying these manuals are used to instruct members on methods for committing violent attacks, grooming and (s)extorting vulnerable minors, or conducting doxing and swatting.
How The Com operates online
Europol described The Com — short for Community — as a decentralized network that lacks a unified ideology. Some factions pursue violent right-wing extremist and accelerationist beliefs, while other elements focus on criminal and coercive practices. According to the agency, Com-affiliated groups recruit and groom victims through social media, messaging apps and gaming platforms, funneling potential members and victims into private forums and chat rooms where radicalisation and victimisation occur. Victims are typically coerced into remaining under perpetrators' control through (s)extortion, Europol said.
Subgroups inside The Com and previous enforcement actions
Europol's earlier statements, cited in this operation, identify multiple subgroups within The Com. Those include Offline Com (promoting property damage, harming others, and committing acts of terrorism), Cyber Com (orchestrating network intrusions and ransomware attacks), (S)extortion Com (coercing minors into sex crimes and encouraging self-harm and suicide), and 764, which surfaced in 2021 and is noted for grooming young people into producing explicit material that is later used for blackmail or shared among members.
The Com has been linked to several high-profile cyber incidents, including alleged ransomware attacks against Las Vegas casino breaches in September 2023 and breaches at Marks & Spencer, Co-op, and Harrods in April 2025. In April 2025, two alleged 764 leaders — 20-year-old Prasan Nepal and 21-year-old Leonidas Varagiannis — were arrested and are now facing life in prison for operating an international child exploitation ring.
Project Compass and recent investigative results
This Referral Action Days operation builds on Project Compass, a yearlong operation launched in January 2025 and led by Europol's European Counter Terrorism Centre that brought together law enforcement from 28 countries. As previously reported by BleepingComputer in February, that broader effort resulted in 30 arrests, identified 179 suspects tied to The Com, and documented 62 victims. Europol also published a notification in January 2025 on the rise of online cult communities specifically targeting young people.
What this means for law enforcement, technologists, and policymakers
- Law enforcement and intelligence agencies: Coordinated referral and removal actions across multiple countries can disrupt distribution channels and produce investigative leads, according to Europol’s stated aims. The operation connects takedown activity to broader cross-border inquiries already under Project Compass.
- Technologists and platform safety teams: Europol’s description highlights the use of coded language, emojis, and a pattern of shifting from public platforms into private forums; detection and moderation efforts will need to address both open and closed channels where grooming and (s)extortion are said to occur.
- Policymakers and regulators: The operation was framed as part of the European Commission’s ProtectEU agenda, underlining a policy-level alignment between takedown efforts and counterterrorism priorities at the EU level.
Europol framed the Referral Action Days as a step in a continuing campaign: to disrupt The Com’s online ecosystem, reduce access to nihilistic violent-extremism content, and cultivate new investigative leads. The agency’s public characterization of the group's tactics — from coded messaging to manuals instructing violence and sexual exploitation — underscores why it remains a focus of multi-national policing and platform-intervention efforts.
