764 Group
Threat Intelligence Brief: “764” Nihilistic Violent Extremist Network
Classification: Internal / Public Awareness
Date: 22 November 2025
Prepared by: Cyber Scout Labs
1. Executive Summary
764 is a decentralized, online sextortion and nihilistic violent extremist (NVE) network that targets children and teens, primarily aged 9–17, through gaming, chat and social platforms. It blends sadistic abuse, sexual exploitation, and extremist symbolism, including influence from groups such as CVLT and the Order of Nine Angles (O9A.
The group uses platforms like Discord, Telegram, Roblox, Minecraft and other common communication apps to groom, coerce and extort minors, forcing them to produce child sexual abuse material (CSAM), self-harm and, in some cases, acts of violence against others.
U.S. authorities classify 764 as a terror-level threat, with the FBI treating it as a tier-one investigative matter and running over 250 active investigations across all field offices.
Law enforcement in multiple countries has arrested key leaders and members, but the network remains active and adaptive.
2. Key Judgments
764 is not “just” a grooming ring; it is an organized, extremist-aligned online terror network that weaponizes sadism and child abuse for status, “currency,” and ideological bonding.
Children are the primary targets, especially vulnerable or marginalized youth and those with mental health challenges. Age range is typically 9–17.
The network uses CSAM and extreme gore as “Lorebooks” (digital collections used as currency and status markers), stored in encrypted “vaults” and traded internally.
Tactics include long-term grooming, blackmail, social engineering and cross-platform stalking, making it very difficult for victims to “just block and move on.”
764 is linked to a broader ecosystem of online extremist communities (CVLT, O9A influence, and similar groups) and is part of a wider phenomenon of nihilistic violent extremism (NVE).
3. Who / What is 764?
Type: Online sextortion and violent extremist network
Founded: Around 2021 by Bradley Chance Cadenhead (“Felix”) after learning grooming and sextortion tactics within the CVLT network.Wikipedia
Ideology:
Accelerationism, nihilism, sadism
Heavy use of Satanic / neo-Nazi imagery, influenced in part by CVLT and O9A, though many members appear more driven by sadism than coherent ideology.
Status:
Members operate in small online cells, use aliases, and frequently migrate between servers, channels and platforms.
4. Platforms & Operating Environment
764 and affiliated groups have been documented using:
Gaming platforms:
Minecraft
Roblox
Messaging & community platforms:
Discord
Telegram
Smaller forums and invite-only chats
Social media & video platforms:
Used to find and profile potential victims
Used to amplify incidents and share screenshots or “trophies” internally
They exploit the false sense of safety parents often feel when kids are “just at home on a game” or on their phone.
5. Tactics, Techniques & Procedures (TTPs)
5.1 Victim Selection
Targets primarily minors aged 9–17, often:
Isolated, neurodivergent, LGBTQ+, or otherwise marginalized
Showing signs of depression, anxiety, self-harm, or family conflict
Initial contact through public game lobbies, group chats, or shared interest servers.
5.2 Grooming & Trust-Building
Pretend friendship, mentorship or romantic interest
Mirroring interests (same games, music, fandoms)
Gradual escalation from harmless chat to sexualized conversation, “jokes,” or dares
5.3 Sextortion & Coercion
Once compromising images or information are obtained, typical patterns include:
Threats to share images with family, school, or online
Demands for more explicit material, often involving self-harm or degradation
Orders to perform acts like:
Self-harm, including carving nicknames into skin (“cutsigning” or “fansigning”)
Animal abuse
Abuse of siblings
Suicide attempts or completed suicide
Planning or discussing mass violence (school attacks etc.)
5.4 “Lorebooks” & Internal Status
Members compile collections of CSAM, self-harm and murder content into digital “Lorebooks”
These Lorebooks are reportedly:
Stored in encrypted “vaults”
Used as currency and status within the network
Used as recruitment tools to “prove” commitment and extremity.
5.5 Cross-Platform Persistence
If a victim blocks one account, offenders reappear under new aliases
They may contact the victim’s friends, family, or school accounts
Content is mirrored in multiple locations, increasing pressure and reducing the victim’s sense of escape
6. Links to Extremism & O9A
Investigations and research organizations have highlighted links between 764, CVLT, and broader extremist ecosystems:
CVLT:
Fascist / neo-Nazi, pro-pedophilia, highly sadistic online community
Emphasizes nihilism and violent transgression as a kind of “ideological game”
Order of Nine Angles (O9A):
Occult neo-Nazi movement that glorifies transgression, sexual violence, and “culling” as a path to personal and societal collapse
Functions as a radicalization pathway toward violent extremism, including for some members active in 764-style networks
764 and affiliated groups borrow symbolism, language, and “edgy” ideological framing from these environments to justify abuse and attract thrill-seeking or already radicalized youth.
7. Scale & Impact
Hundreds to thousands of potential victims worldwide, across North America, Europe, and beyond.
FBI: Over 250 active investigations, all 55 field offices involved.
Documented links to:
Suicides and suicide attempts
Severe self-harm
At least one school shooting referencing 764 in the perpetrator’s online activity.
8. Recent Law Enforcement Actions (2024–2025 Snapshot)
Key leader sentencing (2024):
A member of the 764 terror network was sentenced to 30 years in prison for sexual exploitation of a child, in a case explicitly tied to 764.
Tier-one classification & national investigations (2024–2025):
FBI publicly classifies 764 as a tier-one threat and opens hundreds of investigations.
Leaders of “764 Inferno” charged (2025):
DOJ charged Leonidas Varagiannis (“War”) and Prasan Nepal (“Trippy”) with operating a global child exploitation enterprise linked to 764, using Lorebooks as currency; they face potential life sentences.
German case (2025):
German authorities arrested a dual German-Iranian suspect accused of over 120 crimes tied to 764, including coercing a 13-year-old American boy into suicide on livestream.
Ongoing indictments (late 2025):
Additional 764 members have been indicted for sexual exploitation, coercion, enticement of minors and cyberstalking in recent DOJ actions.
9. Threat Assessment
Primary victims:
Children and teens, especially heavy users of gaming platforms and Discord-style communities.
Secondary victims:
Parents and caregivers (psychological impact, financial extortion).
Schools and communities impacted by self-harm incidents, suicides, and potential offline violence.
Threat characteristics:
High severity: Combines sexual abuse, psychological torture and extremist radicalization.
High persistence: Network persists despite arrests; culture and methods are being replicated by copycats.
High stealth: Offenders hide within normal-looking gaming and chat spaces; abuse is often hidden behind jokes, memes and in-group slang.
10. Indicators & Red Flags
For parents, educators, and front-line workers, key warning signs include:
Behavioral indicators in minors:
Sudden secrecy about devices, especially at night
Use of new or multiple accounts, usernames, or “alt” profiles
Unexplained fear of someone online, or sudden panic about photos getting out
Self-harm marks that include names, tags, or strange symbols carved into the skin
References to “Lore,” “Lorebooks,” “vaults,” “cults,” “764,” “CVLT,” or similar terms in chats
Digital / technical indicators:
Rapid increase in encrypted file sharing, hidden folders, or password-protected archives on a device
Use of VPNs or anonymizing tools suddenly in a minor’s environment
Participation in private “edgy” servers centered on extreme gore, violence, or illegal content
None of these alone prove 764 involvement, but clusters of indicators should be treated as urgent risk.
11. Recommended Defensive Measures
For families:
“Device in public space” rule for younger teens; no unsupervised all-night gaming in closed rooms.
Regular, non-judgmental check-ins:
“Has anyone ever asked you for pictures or to do something that felt wrong online?”
Make one rule explicit:
If something goes wrong online, the child is not in trouble for telling. The shame and fear is what these offenders exploit.
Use parental controls and platform safety features, but do not rely on them alone.
For schools and youth organizations:
Add 764-style grooming / sextortion tactics to existing digital safety training.
Establish a clear, trauma-informed reporting pathway (counselor, SRO, school psychologist).
Train staff to recognize self-harm and online coercion indicators, not just traditional bullying.
For community groups & NGOs:
Maintain relationships with law enforcement and cybercrime support organizations to route high-risk cases quickly.
Prepare low-jargon materials for parents explaining:
Sextortion
Encrypted “vault” / Lorebook concept
How to report and preserve evidence safely
12. Information Gaps & Priority Questions
Despite recent reporting and prosecutions, key gaps remain:
Current size and structure of 764 after leadership arrests
Extent of copycat networks inspired by 764 / CVLT / O9A but operating under different names
Effectiveness of recent platform safety controls (age-gating, content filters, automated moderation) on Roblox, Discord and others in detecting NVE patterns, not just generic
Sources: DOJ, FBI, Washington Post, BBC, The Guardian, Wired, Europol, Tech Against Terrorism, academic research on O9A/NVE, Thorn, NCMEC, U.S. cybersecurity publications, regional news outlets, OSINT community analysis.
