Content warning: this Insight contains references to child sexual exploitation and violence
Introduction
On 12 September 2023, the FBI made a Public Service Announcement about a violent extremist group called ‘764’ involved in sextortion and the creation and distribution of child sexual exploitation material. 764 is an esoteric network of threat actors adjacent to the Order of Nine Angles (O9A) – an esoteric militant accelerationist movement. The announcement was accompanied by several arrests of 764 members, including Angel Almeida in New York; Bradley Cadenhead in Texas; Chandler Pong in Nevada; Kalana Limkin in Hawaii; and a minor in Romania. Analysis of the online activity of O9A and those who adopt their visual aesthetics, such as 764, indicates that there is a significant threat nexus between terrorist and violent extremism content (TVEC) and child sexual exploitation and abuse material (CSAM). This convergence of TVEC and CSAM is mediated through digital platforms and ecosystems, particularly those linked to the gaming space.
This Insight draws on ongoing research into O9A and 764 (and the other aliases under which it operates or has been rebranded) to shed light on the hybridisation of harms from the CSAM and TVEC fields and how these threat actors leverage platforms and technologies to commit acts of sextortion, and plan mass casualty incidents. The authors reviewed court records, public chat logs and social media accounts linked to members of these networks. Private chats and channels linked to the 764 network were not reviewed due to all of them containing child abuse material.
Understanding the Actors
O9A is a decentralised esoteric militant accelerationist network of threat actors who believe that Western civilisation’s Judeo-Christian heritage corrupts modern society. Thus, they seek to overthrow and replace the current order with a new imperial order based on fascism, Social Darwinism and various interpretations of Satanism. They mostly focus on offline activity and have built online networks to advance their accelerationist and nihilistic goals. O9A’s principal aim is the subversion of civil society through the promotion of a variety of immoral and criminal acts, including sexual violence, animal abuse, and murder. Evidence from open source data we have collected indicates that O9A and 764 have a presence on YouTube, Instagram, Discord, Snapchat, X (formerly Twitter), Telegram, Twitch, TikTok, Steam, Mega, and Roblox. They use these platforms for promotional purposes and recruiting potential members and victims.
Ideological Grounding: The ABC Rites of O9A
O9A teachings state that so-called Judeo-Christian values, racial equality, human rights, democracy, communism, and capitalism are intrusive forces opposed to the fulfilment of the ‘Imperium’ and subsequent ascendancy of the Aryan race and must therefore be destroyed from within through esoteric rituals and direct action. The esoteric practices of O9A often combine Hitler worship with occultist trappings and encourage adherents to commit violence, rape, child sexual exploitation, and even the ‘culling’ (read: murder) of human victims to undermine civilisation. O9A embraces all forms of terrorism; though most reporting has been on their association with white supremacy, they have also embraced radical jihadism.
Admission into O9A is a self-guided process which requires an initiate to perform subversive actions to be recognised as a devoted adherent. O9A literature provides suggestions and guidelines on how to accomplish these acts. One such piece of textual evidence lays out the ‘ABC rites of O9A’, which are: assault, business, and criminal organisation.
Per these rites, an initiate must first perform the act of ‘Assault’. Two acts of assault are most commonly recommended: lynching and sexual assault. In their own words, these acts are referred to as ‘Blood Opferings’ and ‘Sex Opferings’, respectively, which are an alternate spelling of ‘offering’. ‘Business’ in O9A is defined as “the art and science of transferring other people’s money into your pocket or bank account”. The criminal organisation aspect of the ABC rites requires the initiate to display their intelligence, creativity, and organisational skills by organising a small group that acts as an independent cell – often referred to as a ‘nexion’ – and planning a coordinated and covert criminal act which will benefit the nexion.
O9A adherents perceive these criminal acts as a way of weakening Western democratic values and thus achieving their accelerationist goals through nihilistic and obscene acts that oppose normative values throughout society. Though less flashy than an act of terrorism, actions such as sextortion, possession of CSAM and sexual violence are key ideological elements of O9A that are part of their accelerationist tactics, techniques and procedures (TTPs) and seen by many as a necessary prerequisite to larger, public acts of violence.
O9A Typology
There are two categories of O9A adherents. Firstly, some are doctrinal believers in the esoteric ideological foundation of O9A, are part of a nexion and have gone through or are going through the self-guided initiatory system. Secondly, some are aesthetic adopters who are not fully committed to the esoteric practices and beliefs held by committed adherents and do not go through the initiatory system laid out in official O9A texts. However, those who adopt the aesthetic do so to make themselves and their group or movement appear to be more dangerous than they are. They adopt the language, acausal valuation (the numbers often associated with O9A nexions with internal esoteric significance), imagery, and accelerationist tactics. These groups or movements may not be ideologically bound to the esoteric practices of true adherents; nevertheless, they are working towards the same accelerationist goals.
764 Origins
764 is an online child extortion group created by a Discord user named Bradley Cadenhead in 2021. According to the statement of facts reviewed by the authors, the investigating officer found that Cadenhead had been fascinated with online content depicting murder and torture from the age of 10. Subsequently, Cadenhead became acquainted with an unknown individual through the online game Minecraft who aided him in starting the group known as 764. 764 took inspiration from another Discord Community known as ‘Cvlt’ that forced children to perform sexual acts on camera, later using the recordings for sextortion.
Unlike Cvlt, 764 does not only leverage the sextortion of minors but also animal torture, incest, rape, self-harm, and bestiality. 764 force victims to carry out four key types of harm that may be recorded and shared on social media platforms or disseminated internally. These include forced drug use and self-harm, such as non-suicidal self-injury with blades or needles, asphyxiation or burning. They also regularly encourage people suffering from mental health problems to kill themselves on camera or commit mass shootings. New members are also encouraged to engage in animal abuse, being forced to injure or kill personal pets or other animals. Sextortion and CSAM are also key dimensions of 764; victims are groomed to share intimate images to be used to subsequently sextort and doxx them, creating ‘LoreBooks’ filled with sexually explicit content to be shared with victims’ friends and family if they don’t comply.
The arrests of Bradley Cadenhead and other prominent members significantly destabilised the community. Internal conflict and doxxing of members led to 764’s ‘official’ dissolution and the creation of various offshoots: 676, CVLT, Court, Kaskar, Harm Nation, Leak Society, H3ll, and others as they evolved. We use ‘764’ as an umbrella term for all these groups due to their shared aesthetic signifiers and operational goals. Between 2022 and 2023, the community rebranded and vacillated under several names, however, the core community is the same.
Recruitment Vectors and Victims
764 recruits members and future victimisers from online communities interested in obscene material, such as those dedicated to gore and the celebration of mass shooters or terrorist and violent extremist milieus. A key nexus for 764 recruitment and socialisation is gaming spaces and adjacent gaming technologies. Games with young player bases, such as Roblox and Minecraft, are principal platforms for predation. After contact is established with a victim, they are invited to join a private space, where grooming and sextortion will occur. Discord serves as the preferred platform for this purpose. Discord’s popularity with 764 arises from the many pre-existing communities they can recruit from on the platform. This ranges from Roblox or Minecraft servers run by 764 users, self-harm servers, gore, etc. Additionally, the ease of server creation and management and the capacity for text, voice, and video communication all make it an attractive platform for their purposes. Much remains unknown about the inner workings of these servers, and the illegality of the content related to the sextortion of minors prevents direct observation for researchers of many core communities and ecosystems. Legal action has only been taken due to tips sent to the National Center for Missing & Exploited Children, as seen with Cadenhead and Kalan Limkin or via investigations by the FBI and law enforcement agencies following a serious crime, as was the case with Kaleb Meritt.
764 focuses on recruiting future members/victims in online communities where vulnerable individuals may be found. Targets are sought in spaces tailored to those with diminished social power or centred around marginalised identities. Notable examples include online communities used by LGBTQ+ youth, racial minorities, and individuals suffering from mental illness. Perpetrators are likely to have increased control over victims who may be more socially isolated or hesitant to seek help than their peers.
According to chat logs reviewed by the authors, several members who become abusers were initially victims who then continued to perpetuate the cycle of violence. Trauma is essential to the preservation and growth of the community; trauma preserves members who are either scared of losing social bonds or accepting what they have done. Victims are turned into abusers and recruiters who do unto others what was done to them. This trauma makes it difficult to perform non-securitised interventions and prevents individuals from seeking help independently.
Ideological Intersections
O9A/764 are not ‘whites-only’ movements but transnational communities with members worldwide. Understanding the threat they pose requires knowledge of this broad recruitment base. Additionally, though 764 members have been arrested on child pornography charges, these individuals initially became known to law enforcement following tips from anonymous individuals or schools in the US, UK, and Romania regarding plans to commit acts of mass violence. Court documents from prosecutions of 764 members consistently reveal inclinations towards acts of both interpersonal and public violence. Additionally, those who interact with these spaces have been shown to interact with TVE content prior to or concurrently with their participation in 764 and related groups.
Documents from the prosecution of Bradley Cadenhead mention that he was first investigated for terroristic threats after being reported by an Assistant Principal in September 2018. Following disciplinary action regarding these threats. Cadenhead continued to exhibit concerning behaviour in school, including the continual use of school devices to draw pictures depicting school shootings.
Chandler Pong, another individual with connections to 764, was arrested on child pornography charges in September of 2022. Pong, like Cadenhead, initially became known to law enforcement during a separate investigation. The Las Vegas Review-Journal notes that Pong’s arrest warrant claims he Pong first became known to law enforcement due to his participation in “violent racially motivated ideologies” and threats of violence. Pong freely admitted his relationship with an underage girl while being investigated for attempts to produce and sell non-serialised firearms (commonly known as ‘ghost guns’).
Additionally, Angel Almeida, a known 764 associate who was charged with possession of child exploitation material in early 2023, was originally arrested nearly two years prior for possession of a firearm as a convicted felon. A search of Almeida’s residence revealed the presence of a handgun, ammunition, and O9A-affiliated literature. Court documents further expose Almeida’s predilections towards violence. A detention memo reviewed by the authors states that his social media includes praise of mass killers, Nazi imagery, animal cruelty, and material alluding to the sexual abuse of children and is “indicative of an interest in violence towards children and animals.” These cases suggest that the possession of CSAM may not be a coincidence but rather a facet of the ideology shared by each individual.
Based on our analysis of the wider esoteric violent extremist ecosystem and that of 764, we have found evidence that 764 users and groups associate themselves with violent extremists motivated by accelerationism. One 764 group of users claim that М.К.У (Maniac Murder Cult, an accelerationist group founded by Egor Krasnov in Dnipro, Ukraine) and 764 have declared an official partnership.
It is also important to also highlight that the majority of threat actors and victims in 764 are minors – the majority of which have marks of self-harm, evidence of trauma or vulnerabilities that make them candidates for recruitment into more kinetically minded TVE groups. The recent English translation of the М.К.У handbook was initially shared via 764 ecosystems, which seek to encourage stochastic acts of violence or terrorism.
Doctrinal knowledge of both 764 and O9A also tells us that the interpersonal violence and abuse encouraged by these groups is viewed as a necessary prerequisite for larger, public acts of violence. Although the press surrounding this group has focused primarily on child exploitation materials produced by members, the network’s ultimate goal is to groom individuals for acts of terroristic violence. Thus, it is crucial for 764 and its related networks to be treated as both a TVE and CSAM issue by lawmakers, law enforcement and tech companies in order to ensure a holistic response to the international threat it poses.
Tech Recommendations
Though combatting movements like 764 requires multisectoral approaches, the platforms on which this content is hosted play an important role in combatting this rapidly emerging threat. Social media platforms must proactively focus on conduct-related risks within communities that 764 and its offshoots recruit potential victims. This includes communities centred around True Crime, mental health issues, and online multiplayer games with young player bases (such as Roblox). The prevalence of cross-platform abuse also necessitates increased communication between platforms with commonly targeted communities and other sectoral partners.
Additionally, platforms must conduct more focused moderation of online communities which overlap with 764 – those related to ’gore’ content, the glorification of mass killers, and containing content romanticising or otherwise encouraging self-harming behaviour such as cutting or disordered eating. Participation in such communities regularly precedes involvement in 764 and its offshoots.
Finally, as more information about 764 becomes publicly available, content creators have attempted to raise awareness of the dangers these groups pose. Although well-meaning, this content is sought out by individuals associated with 764. Users often claim to have a previous or ongoing affiliation with 764 to encourage continued interaction. This content also encourages individuals, either implicitly or explicitly, to seek out more information on the group and possibly put themselves at risk of becoming victims. Increased moderation of this content is necessary to limit the reach of 764’s network, prevent misinformation, and reduce further victimisation.