Violence as a Service: Inside the Market for Swatting and Bomb Threats

Key Insights

• Violence as a service is a functioning market with published price lists. Hoax emergency calls start at $20, and a graded armed-response product we observed on Telegram in July 2026 starts at $85, with a flat 2x surcharge for targets outside the United States and Canada.

• The business model exists to separate the buyer from the act. Of the 193 arrests made in the first six months of Europol's Operational Taskforce GRIMM, only six were instigators, the people who actually ordered the work.

• Enforcement pressure has not yet reached the advertising layer. The channel we observed was trading openly, under a fixed handle, with 6,866 subscribers, after every major action taken against this market to date.

• Corporate offices, hospitals, campuses, and named executives all sit inside the addressable market at the bottom of the price ladder, at a price point low enough for an individual grievance to reach.

Cybercrime Left the Screen

For most of its history, the cybercrime economy sold things that stayed inside a computer. Stolen credentials, access to a compromised host, a laundering service, a phishing kit. The harm was real, but the delivery mechanism was digital, and the distance between the buyer and the consequence was the whole point of the business model.

That distance has closed. There is now a functioning market in which a buyer with a Telegram account and cryptocurrency can commission a physical outcome against a named address: an armed police response, a bomb threat, a brick through a window, a beating and, at the far end of the catalog, a killing. The term for it, used by Europol and by law enforcement more broadly, is violence as a service.

The term is not marketing. It describes a genuine service economy with advertised price lists, repeat customers, proof-of-completion requirements, sellers who trade on reputation, and a labor supply problem that those sellers solve by recruiting children.

Much of what is known about this market comes from prosecutions and from reporting on operations that have already been disrupted. Alongside the public record, this report draws on our own observation of a Telegram channel that was still trading openly at the time of writing. We are withholding the channel's name and handle: it was active when this was written, and naming it does little except route buyers toward it. In July 2026 it carried 6,866 subscribers and a published rate card for what it advertises as "Emergency Services," available in every country, sold on a three-tier severity scale. Its pricing, its self-presentation, and the fact of its continued operation run through the rest of this report alongside the prosecutions.

What Violence as a Service Actually Means

Europol's Operational Taskforce GRIMM, launched in April 2025 and led by Sweden, defines violence as a service as the outsourcing of violent acts to criminal service providers. The agency breaks the chain into four roles, and the arrest figures published after the taskforce's first six months show how the labor is distributed. Of 193 arrests, 63 were perpetrators who carried out or planned the violence, 84 were recruiters, 40 were enablers who facilitated the services, and six were instigators, the people who ordered the work. Five of those six were classified as high-value targets.

That distribution is the most revealing part of the Europol figures. Only six of 193 arrests were people who ordered violence. For each one of them, roughly 31 others were arrested in delivery roles, the largest share of them recruiters. The model is built to put as many disposable intermediaries as possible between the buyer and the act.

The American wing of this market runs through The Com, short for The Community, a loosely federated English-speaking network the FBI describes as spanning multiple interconnected subgroups. On 23 July 2025 the Bureau issued three public service announcements on the same day, splitting its guidance across the network as a whole and the subgroups it names as Hacker Com, In Real Life (IRL) Com, and Extortion Com. The IRL Com advisory is the relevant one here. It states plainly that IRL Com subgroups offer swat-for-hire services through messaging apps and social media, that the operators obscure their identities and are often paid in cryptocurrency, and that swatting serves three separate business functions within the group: revenue, reputation, and internal discipline. On that last point the FBI is specific. When members disobey orders, the member or the member's family may become the target.

A service that can be turned on its own members is not a service in any conventional sense. It is a protection racket with a phone.

Hoax Calls Are the Entry-Level Product

Swatting is the practice of making a false emergency report designed to trigger an armed law enforcement response to an address the caller has no connection to. Bomb threats work the same way against institutions rather than individuals. Both are sold by the call.

The mechanics that matter for defenders are on the receiving end. A call arrives reporting an active shooter at a named building. The address is real, the caller is not there, and dispatch has no reliable way to distinguish the report from a genuine one in the seconds it has to decide. Analysts at the Center for Internet Security and the Institute for Strategic Dialogue found that the callers behind the August 2025 university wave used voice over internet services and Google Voice numbers so that calls appeared to originate locally, and layered in artificially generated screaming and gunfire to make the reports sound authentic. The verification gap is the product. Everything the seller does is aimed at widening it.

What follows is an armed response, a lockdown, an evacuation, a building-by-building search, and hours of institutional paralysis. The consequences are not hypothetical. Andrew Finch was shot and killed by police at his front door in Wichita, Kansas, in December 2017 after a hoax call reporting a murder and hostage situation at his address.

Researcher David Riedman's K-12 School Shooting Database recorded at least 723 swatting hoaxes at American K-12 schools in 2023 alone. Riedman, working with The Economist, put the emergency response cost of a single school swatting incident at a minimum of $100,000. The Anti-Defamation League's 2023 survey found that 11% of teenagers and 5% of adults said they had experienced swatting in their lifetime.

None of it is hidden. The advertising for a service that produces those outcomes runs to six lines and reads like a menu board.

A condensed version of the channel’s rate card, carrying 2,600 views at the time of observation. Seller contact handles are redacted.

There is no description of method, no account of what the buyer is actually commissioning, and no attempt at justification. The post assumes its reader already knows what an "emergency service" is and needs only to pick a severity.

The Price Ladder

At the bottom sit hoax calls. Motherboard reported that the service operating as Torswats charged $75 per school and $50 for what it called an "extreme swatting" against a residence, with discounts for repeat business and separate negotiation for targets who were famous. Purgatory undercut that. Wired reported the group offered fake threats against schools for $20, and $50 against hospitals, businesses, and airports, and the Global Project Against Hate and Extremism recorded the school price rising to $95 after the August 2025 wave generated national coverage. A co-leader who identified himself as Gores told Wired the group had made $100,000 from the hoaxes.

Above that sits physical work. In September 2022 Krebs on Security documented solicitations on Telegram for brickings, tire slashings, firebombings, and drive-by shootings, with advertised payment of $3,000 or more contingent on proof of successful completion, which in practice meant filming the attack. Carrying out the job also meant paying a local getaway driver. Trend Micro's April 2025 research into the Russian-speaking underground found violence-as-a-service offerings advertised alongside conventional hacking tools, and Forbes reported one post in that ecosystem offering to commit grievous bodily harm for $5,000.

At the top sits contract killing, and the prices there come almost entirely from European cases. A Swedish police investigation in Värmland, reviewed by AFP, recorded a 19-year-old offering an 11-year-old boy 150,000 kronor, around $13,680, to carry out a murder, along with clothing and transport to the scene. A Telegraph investigation into the recruitment of teenage girls by Swedish gangs, known within those networks as "Green Women," reported bounties of up to roughly $17,500 for a completed hit.

Advertised price points across the violence-as-a-service catalogue, 2022 to 2026

Across the full catalog, from a $20 school call to a $17,500 contract killing, the ladder spans roughly three orders of magnitude, and price tracks the seller's exposure rather than the damage done. A hoax call requires one anonymous person, one internet connection, and no physical presence. A killing requires a body in a location, which is why the market solves that problem by recruiting people too young to be prosecuted. The buyer of a $20 campus lockdown and the buyer of a $17,500 homicide are shopping in the same ecosystem, on the same platforms, under the same anonymity and payment infrastructure.

Our own observation adds a fourth pricing structure to that ladder, and it is the most commercially developed of them.

The full rate card was posted to the channel in July 2026. Seller contact handles are redacted.

The channel does not price by target. It prices by severity: Level 1 at $85, Level 2 at $135, Level 3 at $225, with the post explaining that "Each response goes up in price and severity, if you want a crazy response you buy a higher severity level." Those are quoted as USA and Canada rates. Everywhere else is charged at double, advertised as "International = 2x Rates," against a stated coverage area of every country. A top-tier response outside the US and Canada therefore lists at $450.

That is a different product from the one Torswats and Purgatory sold. Both of those priced the target: a school, a residence, a hospital, an airport. The channel prices the intensity of the armed response and leaves the choice of target entirely to the buyer. Severity has been abstracted out of the specific victim and turned into a variable the customer selects at checkout, which means the seller is no longer selling a call. It is selling an outcome, graded.

The 2x international multiplier does the same thing to geography. It implies a seller that has some working sense of which jurisdictions are harder or riskier to operate against and has folded that into a published rate rather than negotiating it job by job. Torswats negotiated separately for famous targets. This one has a rate card.

The entry price deserves attention as well. At $85, Level 1 lands between Purgatory's original $20 school call and the $95 that group charged once the August 2025 wave drew national coverage. We saw no escrow arrangement, no deposit terms, and no proof-of-completion language advertised on the channel; the transaction is handled by direct message to the seller. Whatever else enforcement pressure has done to this market, it has not driven the price of an armed police response down.

The Operators

Prosecutors have documented two operations in enough detail to describe them with confidence. A third is documented only by itself.

Alan Filion, of Lancaster, California, operated a swatting-for-hire service under a rotating set of handles including Torswats. According to the Department of Justice, between approximately August 2022 and January 2024 he made over 375 swatting and threat calls, targeting religious institutions, high schools, colleges and universities, government officials, and private individuals, frequently claiming to have planted explosives or to be about to commit a mass shooting. He was 16 for the majority of them. Prosecutors quoted a January 2023 post in which he described the intended outcome of his own product. He said he usually got the police to drag the victim and their family out of the house, cuff them, and search the house for dead bodies. Filion pleaded guilty in November 2024 to four counts of making interstate threats and was sentenced in February 2025 to 48 months in prison.

Purgatory is the larger and more commercially organized of the two. A superseding indictment returned in the District of Maryland in May 2024 charged Owen Jarboe, Evan Strauss, and Brayden Grace with conspiracy, cyberstalking, interstate threatening communications, and threats to damage or destroy by means of fire and explosives, alleging that the defendants were part of an online group known as Purgatory and used Telegram and Instagram to coordinate swattings and to publicize the ones they had completed. Analysts at the Center for Internet Security and the Institute for Strategic Dialogue subsequently assessed that Purgatory members very likely placed the calls that hit at least ten American universities between 21 and 25 August 2025, beginning with the University of Tennessee at Chattanooga and Villanova. Inside Higher Ed, dating the wave from 19 August 2025, counted at least 19 swatting calls against US college campuses.

The third operation sits outside the court record entirely. What we observed is a dedicated channel rather than a swatting offer cross-posted into a general fraud market. It has its own name, its own branding, and an avatar showing a figure in a tactical helmet marked SWAT. At the time of observation it carried 6,866 subscribers. That subscriber count is an audience rather than a customer list, and the distinction matters, because most of those accounts are presumably spectators. But it is a substantial audience for a single-purpose channel, and the rate card posted to it had been viewed 2,600 times.

The channel's public description is the most useful thing on it. It reads: "We dont do anything for fun we aren't sick individuals, our main priority is money," reproduced with the spelling and punctuation as posted. That is a positioning statement, and it is aimed at buyers. The operator is asserting professional detachment: the service is a business rather than a compulsion, and the customer is therefore dealing with a contractor. It maps precisely onto the FBI's finding that swatting inside these networks functions first as revenue.

The rest of the channel undercuts the claim. Its media gallery mixes photographs of smashed vehicle windows and figures in balaclavas with booking photographs, courtroom imagery, and screenshots of internal disputes over money. One visible fragment references figures of 300,000 and 20,000 in an unstated currency, apparently a payment between members. This is the reputation infrastructure. In the absence of vouches, reviews, or escrow, the gallery functions as a portfolio, offering evidence that responses were delivered alongside evidence of what happens to people who cross the group.

The advertising is iterated rather than static. We observed two versions of the same rate card on the channel, one of them edited after publication. The two use different capitalization and different framing of the same three price points. The longer version drew 145 views and five comments. The condensed, edited version drew 2,600 views and seven reactions. A seller that rewrites its ad copy and watches which version performs is running a marketing function, not just a Telegram account.

Law Enforcement Action

The response has escalated on both continents and it is now being run as counter-organised-crime and counter-terrorism work rather than as cybercrime.

Europol’s Project Compass, launched in January 2025 and drawing in law enforcement from 28 countries, had produced 30 arrests, identified 179 suspects and safeguarded 62 victims as of February 2026. OTF GRIMM produced the 193 arrests described above in its first six months. On 24 July 2026, Europol announced that investigators from nine countries — Belgium, Finland, Hungary, Ireland, Luxembourg, the Netherlands, Portugal, Spain and Sweden — had referred an estimated 4,340 URLs tied to the network to platforms for removal during Referral Action Days held across June and July, in an operation organised by Europol’s EU Internet Referral Unit and Spain’s CITCO.

Prosecutions in the United States have followed the same trajectory. On 30 April 2026 the US Attorney’s Office for the Eastern District of Pennsylvania announced charges against a juvenile who identified as a member of Purgatory over swatting calls against universities, with prosecutors stating that the victim institutions were selected at random and that the defendant had no affiliation with any of them.

The visible effect on the supply side is harder to find. The channel described above was still advertising in English, on Telegram, under a fixed handle, with a public subscriber count in the thousands and a published price list, in July 2026 — after GRIMM, after the three FBI advisories, after the Purgatory indictment, and after the Eastern District of Pennsylvania charges. Nothing about the channel suggested a seller adapting to pressure. It had not migrated platforms, had not obscured its pricing, and had not moved to a request-only model. That is a single observation and not a market survey, but it is a useful counterweight to arrest totals: 193 arrests in six months coexists with open advertising at scale.

What This Means for Security Teams

Treating this as a law enforcement problem that happens to other people is the mistake. Corporate offices, hospitals, campuses, and named executives are all inside the addressable market at the bottom of the price ladder, and at $85, the entry price on the channel we observed, a call is cheap enough to be used as a harassment tool by a disgruntled customer, an activist, or a competitor's contractor. The advertised coverage is worldwide, so a non-US footprint is not a mitigation. It is a 2x surcharge.

The reconnaissance that precedes a swatting is a data problem. The dossier is built from home addresses, family details, and executive travel patterns sourced from breach data and people-search sites, which means physical security and cyber threat intelligence functions need to be talking to each other. A verification channel arranged with local police before an incident is worth more than any process designed after one.

Actionable Takeaways for Defenders

• Brief physical security and threat intelligence together. The reconnaissance behind a swatting call is open-source data work, and neither function sees the whole picture alone.

• Agree on a verification channel with local law enforcement now. A pre-existing point of contact is the most reliable way to compress the decision window on the receiving end of a hoax call.

• Monitor executive home addresses and family details in breach and people-search data. This is the raw material the calls are built from, and it is the one part of the chain a defender can remove.

• Treat an inbound threat report as a possible attack in its own right. In a swatting, the call is not a warning about an incident. It is an incident.

• Do not count a non-US footprint as mitigation. Coverage is advertised worldwide, and operating outside the US and Canada raises the seller's price rather than the buyer's difficulty.

Violence as a service did not appear because criminals became more violent. It appeared because the infrastructure that made fraud scalable works just as well for arranging harm to a body as it does for arranging harm to a bank account: anonymous messaging, cryptocurrency settlement, and an inexhaustible supply of teenagers looking for status. The market did not need to be invented. It only needed a price list.

Obvane Cybercrime Intelligence