From Swatting to Sextortion: The Dark World of Purgatory and 764

A.G. SCHEFF~ Honestly, there is no honor among thieves

A federal grand jury returned a superseding indictment on May 9, 2024, targeting a trio of young individuals from Maryland, Virginia, and Ohio. Owen Jarboe (18) of Hagerstown, Maryland; Evan Strauss (26) of Moneta, Virginia; and Brayden Grace (18) of Columbus, Ohio, are accused of conspiring as part of the Purgatory group—a sub-group of 764 in Sextortion Com—to engage in a range of offenses, including cyberstalking, swatting, and other forms of coordinated digital intimidation.

The press release detailed how the defendants exploited digital platforms and open-source intelligence to gather personal data and orchestrate false emergency calls, triggering real-world law enforcement responses. Beyond these tactics, court documents reveal a disturbing overlap with more severe crimes, such as sextortion and the exploitation of minors—one instance involved coercing a minor into self-harm during a video call, as well as attempted kidnaping. This case exposes a multifaceted criminal enterprise that skillfully blends cybercrime with offline criminality, which highlights the challenges of combating hybridized threats. This case illustrates how these hybridized violent extremist networks operate and the tangible harms they cause to their victims while evading traditional methods of detection.

1.Charges and Overview of the Case

The indictment alleges that the defendants, along with co-conspirators known and unknown to the Grand Jury, knowingly planned and executed a scheme to use electronic communications to cause harm, fear, and emotional distress. They conspired to use computers and other communication systems to threaten and intimidate not only their targets or their target's immediate family members and close associates.. The defendants are accused of willfully transmitting interstate threats and maliciously spreading false information about planned violent acts, such as damaging property by fire or explosives. These actions, taken together, represent a coordinated effort to inflict significant emotional and physical harm.

• 18 U.S.C. § 371 (Conspiracy)
• 18 U.S.C. § 2261A(2)(B) (Cyberstalking)
• 18 U.S.C. § 875(c) (Interstate Threatening Communication)
• 18 U.S.C. § 844(e) (Interstate Threat Involving Fire or Explosives)
• 18 U.S.C. §§ 2251(a) (Sexual Exploitation of Children)
• 18 U.S.C. §§ 2252A(a)(5)(B) (Possession of Child Pornography)

The conspirators' goal was to trigger police and emergency responses by making false reports of violent incidents at specific locations. In other words, they made swatting calls designed to send armed law enforcement teams to a target’s address, with the clear intent of threatening, intimidating, and harassing individuals and organizations.

The conspiracy involved members of an online group called Purgatory who described themselves as "“WELCOME TO PURGATORY DOXX1NG AND SWATTING GROUP of 2024.”. The defendants and their co-conspirators used various messaging apps to privately coordinate plans for doxxing and swatting. They also publicly promoted their actions on a Telegram page—posting photos, news reports, and messages to claim responsibility for swatting attacks and even advertise their "swatting services." To conceal their identities when placing these calls, they used VoIP services like TextNow or Google Voice, which allowed them to hide their real phone numbers and IP addresses. Additionally, they created and shared scripts to standardize their swatting calls.

In furtherance of their violent extremist goals, the three individuals carried out a series of overt acts between December 2023 and January 2024. Members of Purgatory, operating under various aliases such as “hellsruin,” “ex-nightmare,” and “bit coin,” coordinated on multiple platforms including Instagram, Telegram, and VoIP services like TextNow and Google Voice. For example, on December 10, 2023, one suspect sent a message in an Instagram group chat, announcing the return of Purgatory and aligning themselves with another Com group called Hells Gates. Just a few days later, Grace shared a swatting script in the same chat, boasting about orchestrating calls that would send bomb squads and SWAT teams to targeted locations. The conspirators also expanded their reach by creating both public and private Telegram channels—one of which was titled “Purgatory”—where they claimed responsibility for various swatting attacks and promoted their “swatting services” to other member in the Com Network.

The acts did not stop with online chatter. On January 3, 2024, they used a TextNow number to call the Houston County, Alabama Sheriff’s Office, falsely claiming he had shot a woman and was holding a hostage at a specific address. In another instance, using Google Voice, one suspect phoned the Newark, Delaware Police Department on January 4, 2024, falsely reporting gunfire at a high school. These phone calls were designed to conceal the conspirators’ real identities by masking their actual phone numbers and IP addresses.

In another instance, they used a TextNow number to call from Maryland to the Houston County Sheriffs Department in Dothan, Alabama. During this call, they falsely claimed to be Victim #1, stated that they had shot his son, threatened to burn down Lot 2 of a residential trailer park in Cowarts, Alabama, and warned that he would kill any law enforcement officials who responded. Shortly after this call, a conspirator posted on the Purgatory Telegram Channel, sharing links to news reports and a photograph of the law enforcement response to the Cowarts swatting incident. The message mocked the victim and celebrated the chaos caused by their actions. In another instance, also using a TextNow number, a conspirator placed a call from North Carolina to the same department in Dothan, falsely reporting that he was at Victim #1’s residence, claiming he was armed, that he had shot someone in the face, and that he was holding another person hostage. They almost always shared news links about their swatting calls on their Telegram channels, to celebrate them, and have them shared in Com to give their group more clout. One conspirator posted a screenshot from a chat about a swatting incident at a pizza restaurant, while another threatened to “blow up” a casino unless a ransom was paid.

2.Tactics, Techniques, and Procedures (TTP)

This case highlights the calculated manner in which victims were identified, targeted, and manipulated. The court documents offer detailed insights into the selection and targeting process:

• Selection and Vulnerability:
The primary victim in this case is a minor female. According to the affidavits, they initiated contact with her around November 2023 via Instagram. Her emotional and psychological vulnerability was exploited through a combination of social engineering techniques and fake e-romances/e-dating. In one case they engaged with these young victims in TikTok communications (recovered as part of the investigation). One minor victim detailed her struggles with severe mental health issues, while they continued to groom her—calling her the love of his life and making promises that blurred the lines between manipulation and exploitation.

• Targeting Tactics on Social Platforms:
Platforms such as TikTok, Discord, Telegram, Instagram served as the primary venue for these interactions. Communications were marked by a chilling mix of coercion and intimidation. For example, during a recorded Instagram video call, one suspect is heard ordering the victim to engage in self-harm by carving his name into her skin, threatening that failure to comply would result in him “calling SWAT on her house.” This explicit threat was not an isolated incident but part of a broader pattern of intimidation designed to exert control over his victims . In another instance a minor female victim from Florida was contacted by the defendant via Xbox and he solicited from her pornographic images and photos depicting self-harm.

• Swatting and Digital Harassment:
Beyond direct victim exploitation, the perpetrators also used swatting as a method of harassment. Detailed court documents note that the defendants would conduct extensive OSINT investigations and coercion to gather personal details about potential targets, including names, addresses, and even family members’ information. This information was then used to make or threaten to make false emergency calls, generating a highly disruptive and dangerous response from law enforcement. Such tactics are intended to create chaos, deter victims from seeking help, and demonstrate the power the network holds over individual lives.

Excerpt from Court Documents
The threats began a few days after they first met and were repeated on multiple occasions. [He] also threatened to make Victim 1 watch him kill her little sisters. [He] also found out Victim 1s home address and threatened to "swat" her. After weeks of threats, [He] told Victim 1 to cut herself. He directed her to cut his online name, Reaper, into her thigh. He told her "if you don't, I'm calling SWAT on your house right now." To protect her sisters, Victim 1 cut "Reaper" into her upper thigh.

• Cross-Platform Messaging and Anonymity:
The perpetrators frequently used pseudonyms, VOIPs and burner numbers, to mask their identities and obscure the trail of evidence. This practice is common in digital extremism, where anonymity provides a shield against law enforcement. The defendants’ reliance on encrypted messaging and social media not only complicates digital forensics but also creates an echo chamber where extreme views are continuously reinforced. This multi-layered approach to communication allows the network to operate in a decentralized manner, reducing the risk that any one member can compromise the entire operation.

• Offline Recruitment and interaction:
Beyond their digital exploits, one conspirator in particular actively "engaged in offline recruitment and interaction to further the 764 criminal enterprise." Court testimony and exhibits reveal that he recruited underage girls from other states. In his interview he admitted that he had taken minor females from South Carolina and New York and brought them back to his home. In one instance, he manipulated his father to drive a 16-year-old girl from North Carolina—whom the family mistakenly believed was 18—back to their home in Virginia. Despite discovering her true age, the family failed to notify authorities until a missing person report prompted law enforcement intervention. These offline interactions were not isolated; rather, they were part of a broader pattern where his family's negligence led them to not only tolerate but actively facilitate his behavior by failing to intervene when he brought underage girls into his home.

3.Vulnerabilities, Grievances, and Radicalization

• Mental Health and Cognitive Challenges:
Court records reveal troubling aspects of one suspect's personal profile. In one document, it is noted that he has significant cognitive limitations—reportedly having an IQ of 75—and is on the autism spectrum. His mental health issues have been cited in cross-examination excerpts, painting a picture of an individual whose vulnerabilities were exploited by the very network he helped lead.

• Emotional Grievances and Social Alienation:
The behavior of the three defendants, as documented in court records, suggests a deep-seated sense of social alienation and grievance. They constructed a self-righteous narrative in which their actions were justified as “protective” measures aimed at helping vulnerable females—a narrative that starkly contrasts with the reality of their coercive and predatory behavior. In example one of the accused "in his January 24 interview stated that his purpose for participating in the Community was to protect females and gather intelligence to help law enforcement." This cognitive dissonance, wherein they simultaneously portrays themselves as a guardian and a perpetrator of abuse.

• Reinforcement Family Dynamics
According to documentation, the Court determined that one of the defendant’s parents have essentially enabled the defendant’s behavior, or at the least were willfully ignorant of his actions and the danger he has posed online and with minor females. The defendant also has a history of violence towards his parents, with pending domestic charges from February 2024. The underlying charges occurred in the same home where the parents live. After seizure of his devices on January 24, 2024 by the FBI, the defendant obtained additional phones/devices which were in his possession upon arrest and of which his parents were unaware. Though there are four other adults living in the home, they have a history of giving in to the defendant’s demands after violent outbursts or upon the threat of violence.

• Reinforcement Through Group Dynamics:
The Com Network, and specifically this case “Purgatory,” served as a breeding ground for these nihilistic and misanthropic ideologies. Within this network they found not only validation for their actions but also encouragement to escalate this behavior. The network’s dynamics are one where aggressive tactics like swatting, murder, forced self-harm, and sextortion are normalized.

• Sexual abuse:
One suspect's vulnerabilities are compounded by a harrowing history of sexual abuse. He once sought help at a mental health hospital—a place that should have offered support—but instead, he was raped. This traumatic experience has left him deeply scarred and fearful of returning to such facilities. Even routine interactions, such as a 911 call, can trigger intense panic as he dreads being forced back into an environment where he was once violated. These deeply personal and hidden wounds not only exacerbate his emotional instability but also fuel a broader pattern of grievance and mistrust, contributing to his radicalization.

Conclusion

In conclusion, the investigation into Purgatory's activities exposes a deeply concerning evolution of cyber-enabled criminal behavior. The case highlights a multifaceted criminal enterprise that seamlessly blends digital tactics—such as swatting, cyberstalking, doxxing, and online grooming—with overt acts of violence and exploitation in the real world. The defendants not only manipulated technology to conceal their identities and coordinate their attacks but also exploited offline vulnerabilities by recruiting underage girls and leveraging family dynamics to facilitate their behavior.

This complex interplay between digital abuse and physical intimidation illustrates a hybrid threat landscape where aggressive online interactions translate into real-world harm. The use of VOIP services, encrypted messaging, and burner numbers allowed these criminals to evade detection while perpetrating swatting attacks, coerced self-harm, and even sexual exploitation. Furthermore, the documented offline recruitment practices and family complicity underscore the broader societal failures that can enable such extremist behavior to flourish.