Swatting-for-hire cybercriminal group 'Purgatory' linked to AI-enhanced swatting calls targeting universities

A cybercrime group known as “Purgatory” has been identified as the organization behind a string of AI-enhanced swatting calls that triggered lockdowns at universities across the country in late August.

From August 21 to August 25, at least 10 universities received fake active shooter reports, prompting armed responses from federal and local law enforcement. Purgatory used AI tools to mimic the sounds of screaming and gunfire during the calls, making them appear more credible, according to findings from the Center for Internet Security and the Institute for Strategic Dialogue.

Purgatory operates primarily through Telegram and Discord and is connected to a larger cybercriminal network called “The Com,” short for “The Community.” That network is known for swatting, sextortion, and distributing child sexual abuse material. The FBI issued a warning about the group last July, citing a rise in the sophistication of its crimes over the past four years.

John Cohen, executive director of the Countering Hybrid Threats Program at the Center for Internet Security, told the New York Post that the group’s motives vary.

“Sometimes [the call’s] are for a fee, other times it’s to bring attention to themselves as a group so that they can get new clients or get others to join this affiliation, and help them do swatting,” Cohen said. “Sometimes, quite frankly, it’s because they enjoy the thrill of watching.”

A Wired report previously revealed that Purgatory offers swatting services for as little as $20, with one group leader allegedly earning $100,000 from the hoaxes.

The wave of incidents began on August 21 with reports of an active shooter at the University of Tennessee Chattanooga and Villanova University. On August 24, similar calls targeted the University of South Carolina and UNC-Chapel Hill. The following day, six campuses were hit, including Iowa State, Kansas State, the University of Maine, and the University of Arkansas.

“We had the initial call come in, just before 12:30. The caller stated that he was in our library, which is Mullins Library, and that there was a guy with a gun in the room,” Matt Mills, the assistant police chief at the University of Arkansas Police Department, told The New York Post. “A call went on for a couple of minutes toward the end of the call, our dispatcher could hear gunfire in the background.”

Authorities later determined the shooter threat was a swatting call after clearing several campus buildings.

Earlier this year, several Purgatory members pleaded guilty to swatting-related charges, including two 18-year-olds. One of them had briefly appeared on the FBI’s Most Wanted List prior to his arrest.