Loading threat actor…
8884 is a splinter group associated with the broader 764 violent extremist ecosystem, an online nihilistic network linked to the coercion and sexual exploitation of minors. Reporting ties 8884 to the wider "Com" milieu and to abuse-focused online communities that use social media, messaging platforms, gaming services, chat rooms, and video platforms to identify, groom, extort, and control vulnerable victims. Known activity attributed to 8884 centers on child sexual exploitation, sextortion, and coercive abuse rather than financially motivated intrusion. Members and leaders have been accused of blackmailing minors into producing child sexual abuse material, self-harm content, degrading acts on camera, animal abuse, and other violent material. The group’s methods align with broader 764 tradecraft: online grooming, psychological manipulation, threats, extortion, use of co-conspirators, and pressuring victims to recruit or coerce additional victims. 8884 has been publicly described as an offshoot or splinter of 764. One identified administrator and leader of 8884, Alexis Aldair Chavez, also used the aliases Zack and Zack8884 and pleaded guilty to multiple crimes involving the sexual exploitation of children. This places 8884 within a wider cluster of 764-linked subgroups and affiliates that have drawn sustained law-enforcement attention. The broader 764 network is widely characterized as a decentralized, youth-heavy, nihilistic violent extremist collective whose participants have been implicated in child exploitation, sadistic coercion, and the production of violent abuse content. Within that landscape, 8884 appears to function as a subordinate or affiliated node rather than a distinct nation-state actor, advanced persistent threat, or espionage service. No high-confidence information in the available material indicates state sponsorship or geopolitical tasking.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An offshoot of 764 involved in child sexual exploitation, coercion, sextortion, and abuse of minors.
A splinter group of 764; described as involved in crimes related to sexual exploitation of children (CSAM-related activity) under the direction/administration of identified individuals.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.