UK Cybercrime Journal: Teenage Online Extremism Cases in 2026

-

What Happened

Four notable UK prosecutions illustrate the growing intersection of cybercrime, online exploitation subcultures, and digital terrorism involving teenage offenders:

Scattered Spider Operators Sentenced for Transport for London (TfL) Hack:

  • In July 2026, Thalha Jubair (20) and Owen Flowers (18) were sentenced at Woolwich Crown Court to five years and six months each in prison. Convicted under Section 3ZA of the Computer Misuse Act (CMA), reserved for attacks causing serious damage to critical national infrastructure, the pair, operating as part of the "Scattered Spider" collective, breached Transport for London (TfL) in late August 2024.
  • Initiated when Flowers was 17, the attack bypassed two-factor authentication (2FA) by social engineering a TfL help-desk worker over the phone. The intrusion knocked 148 internal IT systems offline, forced in-person password resets for 27,000 staff, exposed up to 10 million customer records, and incurred £29 million to £39 million in operational and recovery costs. 

"The Com" Online Exploitation Network: 

  • In August 2026, Justin Swaddle (20) of Leeds was sentenced at Leeds Crown Court to two years' imprisonment, alongside a 10-year Sexual Harm Prevention Order, following a National Crime Agency (NCA) investigation.
  • Swaddle, who began offending at age 17 under aliases such as "Epstein" and "Moscow" across Telegram, Discord, and Snapchat, operated within "The Com," a decentralised online network of youth engaged in cyber-extortion, harassment, and swatting.
  • Swaddle used doxxing threats and intimate images to blackmail 117 female victims worldwide (aged 13–17) into self-harm and sexual abuse for peer recognition and status within the community.  

Cybersecurity Provisioning for Proscribed Terrorist Groups:

  • In July 2026, Yusuf Shah (18) of Ilford was convicted at Kingston Crown Court of multiple offences under the Terrorism Act 2000 following an investigation by Counter Terrorism Policing (CTP) London.
  • Radicalised online from age 13, Shah offered technical capabilities to proscribed groups via Telegram, authored a bespoke manual titled "A Guide on Cybersecurity" for Tehrik-e-Taliban Pakistan (TTP), and facilitated an untraceable $1,376.51 cryptocurrency donation to Al-Qaeda using privacy techniques he developed.
Online Consumption of Violent Terrorist Ideologies and Material:
  • In June 2026, Shuja Gibraeel Mohsin (20) of Mitcham was found guilty following a two-week trial at the Old Bailey  under the Terrorism Act 2000. The trial found he was reportedly drawn in online to extremist and terrorist material and ideologies from when he was only 14 or 15 years old.
  • Mohsin was initially stopped in January 2024 by Counter Terrorism officers at Heathrow airport as he returned to the UK from a trip to Pakistan. Specialist officers carried out an examination of his device, as well as a USB stick.
  • On his devices they found evidence that he had been viewing material and joined various chat groups linked to extreme Islamist groups, including the Taliban, Hamas and Daesh. The material he was consuming and sharing included a bomb-making manual, as well as various Daesh execution video that Mohsin had sent to an online contact.
Analyst Comment
These four cases highlight the convergence of youth radicalisation, gamified cybercrime, and specialised technical skill sets among digital natives. Dedicated cybercrime forums act as the initial sourcing layer. Young threat actors can acquire infostealer logs, exploits, hacking tools and techniques, anonymous VPSs, and vishing scripts. Underground forums provide the reputation systems (escrow, vouches) that allow young cybercriminals to build credibility and congregate with like-minded individuals.

In ecosystems like "The Com" and groups like Scattered Spider, financial gain is frequently secondary to online status, notoriety, and peer validation. Criminal activities are gamified across platforms like Discord and Telegram, accelerating escalate-to-harm behaviors among adolescents. These cybercriminals are also more often than not also involved in cyber sextortion of teenage girls alongside their hacking campaigns against companies in the UK.

For the online extremism and terrorism cases, both individuals entered the radicalisation funnel as teenagers who were drawn into unmoderated chat groups platforms that allowed the open consumption of violent ideology, execution media, and extremist publications. Worryingly, UK-based adolescents are no longer just targets for propaganda. The digitally literate youth now act as force multipliers for terrorist groups, providing operational capabilities like cryptocurrency privacy strategies and custom cybersecurity documentation.

Defensive Takeaways
  • Youth Early Intervention: Government, law enforcement, and educational environments must continue to leverage reporting channels like the UK's ACT Early framework to identify radicalisation or cybercrime recruitment before technical skills are monetised illicitly.
  • Expand Digital and Cybersecurity Literacy: Educational institutions must expand their focus beyond traditional political and ideological extremism to address gamified and glorified cybercrime and other violent subcultures like sextortion.
  • Promote the NCA Cyber Choices Program: Schools, colleges, and universities noticing students exhibiting advanced technical aptitudes paired with anti-social behavior should refer them early to the National Crime Agency’s (NCA) Cyber Choices program. The program proactively redirects youth toward ethical hacking, computer science degrees, and legitimate cybersecurity careers before they cross criminal boundaries.
  • Platform Duty of Care: Online social platforms, specifically messaging platforms like Telegram, Discord, and Snapchat, must be held accountable for hosting online extremism groups, enabling sextortion, hosting violent terrorism content. Such platforms should be co-operating with law enforcement to rapidly takedown such groups and content and support the identification of individuals responsible for sharing and generating it for arrest. 
Relevant Sources
Relevant CT Sources

Popular posts from this blog

Ransomware Tool Matrix Project Updates: May 2025

-
Image
Introduction This blog is a summary and analysis of recent additions to the Ransomware Tool Matrix (RTM) as well as the Ransomware Vulnerability Matrix (RVM) .  Feedback from the infosec community about these projects has been overwhelmingly positive and many researchers have contacted me to tell me how helpful they have found these to be.  It makes me happy to hear how doing something in my spare time can help stop ransomware attacks and cybercriminals from exploiting our society’s systems. And it is for that reason, I shall continue to maintain these projects as long as ransomware is still around.  For anyone new to these projects, please read the descriptions on GitHub or feel free to watch my talk explaining the project at BSides London . Background on the current ransomware ecosystem as of May 2025 Following the impact of Operation Cronos against LockBit and the exit scam by ALPHV/BlackCat, the ransomware ecosystem has been even more unstable than usual.  The e...
Read more

Lessons from the BlackBasta Ransomware Attack on Capita

-
Image
Introduction When a company that manages data for millions of UK citizens falls victim to ransomware, the whole industry should pay attention to it. On 15 October 2025, the UK Information Commissioner’s Office (ICO) published a detailed 136 page report about the Capita breach.  The aim of this blog is to extract actionable cybersecurity lessons from the ICO’s findings as well as open source reports surrounding the breach from a cyber threat intelligence (CTI) analyst’s perspective to help SOC and CERT teams, and CISOs understand what happened and how to avoid the mistakes made by others. BLUF Incident Impact Summary: Capita was attacked by BlackBasta ransomware in March 2023 Over six million individual’s records were exfiltrated from Capita’s systems A £14 million fine was issued to Capita by the ICO Capita said in May 2023, the incident cost up to £20 million to recover Important context about Capita The Capita Group is a business process outsourcing (BPO) and professional servic...
Read more

Raspberry Robin: A global USB malware campaign providing access to ransomware operators

-
Image
Logo credit: RedCanary Ever since it first appeared in late 2021, the Raspberry Robin malware campaign has been propagating globally. A number of threat intelligence reports by vendors such as RedCanary (who named it) and Microsoft (who track it as DEV-0856/Storm-0856) have covered the malware campaign in great detail.  In fact, the list of blogs I do recommend to read to catch up on this threat are as follows: https://redcanary.com/blog/raspberry-robin https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity https://blog.sekoia.io/raspberry-robins-botnet-second-life/ https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/ https://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis/ https://securityintelligence.com/posts/raspberry-robin-worm-dridex-malware/ https://blogs.cisco.com/security/raspberry-robin-highly-evasive-worm-sprea...
Read more