Research Brief · Nihilistic Violent Extremism
Platforms of Harm: 764's Use of Technology for Child Exploitation
Analysis of the platforms used in 68 incidents tied to the 71 named perpetrators in PERIL's 764 Relational Network.
764 is a transnational nihilistic violent extremist network that targets, sexually exploits, and coerces minors and other vulnerable people online. Its crimes follow a three-stage pattern, and each stage relies on a different mix of platforms. Discord and Telegram form the operational core of 764 crimes, appearing in more cases than every other platform combined. But the network is deliberate about where it does what: it meets victims on the gaming and social media apps where they already are, moves them into private and end-to-end-encrypted channels to coerce them, and then broadcasts the resulting exploitative content back to the wider network.
Count of distinct named perpetrators linked to each platform by an edge in the network (n = 63 of the 71 named actors who have a direct tie to 764 and a known platform). Most operate across several; figures sum to more than 63.
First contact rarely happens in 764's own spaces. Perpetrators exploit mainstream gaming platforms and social media apps, where they can approach minors at scale and without scrutiny. Gaming services, including Roblox, Counter-Strike: Global Offensive (CS:GO), and Minecraft, and social media applications frequented by youth, such as Snapchat, TikTok, and Instagram, function as recruiting sites, alongside public Discord servers.
Who is targeted: overwhelmingly children, with documented victims concentrated between the ages of 11–15 and heavily skewing toward young girls. The network deliberately targets vulnerable minors who signal isolation, mental-health struggles, or suicidal ideation, as well as adults in acute crisis.
Distinct perpetrators documented making first contact with a victim on each platform, coded from case records and court documents.
Discord ➞ coercion (Incident #1579, Bangor, Pennsylvania). Per the federal complaint, "Minor Victim One met Matthew [Pysher] via an online platform called Discord" on a server tied to self-harm and cutting. Over roughly three months, Pysher allegedly pressured the newly 13-year-old into sending explicit images and filming self-harm, then he flew across the country to meet her in person.
Roblox ➞ Discord, the hand-off into Stage 2 (Incident #1562, Halethorpe, Maryland). Per his plea agreement, Erik Lee Madison "first contacted victims through Roblox," then "moved communications to Discord, Telegram, Snapchat, and Instagram," where he coerced them into self-harm and sexually explicit live-streaming. He allegedly used the recordings of the acts to keep control of his victims.
Sources: U.S. v. Pysher, 2:26-mj-00971 (C.D. Cal.); U.S. v. Madison, 1:25-cr-00364 (D. Md.).
Once contact is made, perpetrators pull victims off of public sites and into private and end-to-end-encrypted channels where coercion is shielded from moderation: Discord direct messages, voice and video calls, and invite-only servers, plus Telegram and niche encrypted apps such as Wire.
The coercive pattern is consistent: extort intimate images or videos from the victim, then escalate using threats of exposing the content to family, friends, and classmates. Demands increase for documented "fansigns" and "cutsigns" (carving the abuser's moniker into the skin), self-harm, and animal abuse. Each new image or video is used as leverage for the next act.
Distinct perpetrators documented grooming, extorting, or coercing a victim on each platform, coded from case records and court documents.
Coerced images ➞ blackmail to escalate (Incident #1555, Downey, California). Per the federal complaint, Dong Hwan Kim "enticed [minors]... to produce and send him pictures and videos of themselves naked," and "would then extort his victims, threatening that he would send the pictures and videos to their family members and others" unless they produced more. The blackmail escalated to demands for self-harm content, including cutting his "Ryzen" moniker into their skin. The content was then sent to Kim on Discord.
The sextortion spiral (Incident #1675, Spijkenisse, Netherlands). Posing as a teenage girl on Snapchat to obtain a first nude image, "Turpien" allegedly then threatened "to send the images and victims' personal details to family, friends, and classmates unless they produced new and increasingly extreme, degrading content," including forcing victims to carve "Turpien is my owner" into their bodies.
Sources: U.S. v. Kim, 2:25-cr-00743 (C.D. Cal.); District Court of Dordrecht (Netherlands), June 3, 2026.
Extracted content, including CSAM, self-harm imagery, and documented animal abuse, is then circulated back to the wider network to gain clout. Discord and Telegram dominate this stage in roughly equal measure, but in different roles. Telegram is the archival hub: it hosts the channels, "Lorebook" dossiers, and encrypted "vaults" where exploitative material is stored, traded, and used to recruit and gain status, and every documented content-circulation link in the network points to it. Discord is the venue for the most extreme escalation: the live-streaming of self-harm, suicide, and violence to assembled audiences of network members.
The escalation: harm moves from traded imagery to live broadcast, and from victims hurting themselves to victims being coerced into violence against others.
Distinct perpetrators documented distributing, trading, or broadcasting exploitative material on each platform, coded from case records and court documents. All 10 dedicated content-circulation communities in the network are linked to Telegram.
Live-streamed suicide on Discord (Incident #1681, Kyrgyzstan). A 25-year-old man in a mental-health crisis was encouraged by a 764 member ("Fmlk") to take his own life while "live streaming the act to an audience on Discord." More than two dozen viewers witnessed the act.
Selling & archiving on Telegram. One Dutch perpetrator allegedly "sold victims' images and shared their personal details in private Telegram groups that he administered"; a perpetrator known online as "Riley" reportedly distributed and sold CSAM on Telegram; Nino Luciano posted footage of a murder to Telegram; and Jairo Tinajero allegedly published a victim "Lorebook" across 764 Telegram and Discord channels.
Sources: NVE Tracker record #1681 (corroborated by The Washington Post, Dec. 10, 2024); records #1675 and node profiles for Riley, Luciano, and U.S. v. Tinajero (W.D. Ky.).