Who is ‘Purgatory’? The group behind the spate of active shooter hoaxes

(NewsNation) — A loosely affiliated cybercriminal group called “Purgatory” is responsible for a recent wave of fake active shooter threats targeting universities across the United States, according to a new intelligence report from the Center for Internet Security.

University swatting hoaxes began Aug 21, 20 campuses affected

The swatting incidents began Aug. 21 at the University of Tennessee at Chattanooga and Villanova University, where students were gathered for a start-of-school Mass that turned to chaos before authorities realized it was a hoax.

Since then, at least 20 similar false threats have struck campuses across the country including:

• University of South Carolina
• University of Colorado Boulder
• Iowa State
• Kansas State University
• University of New Hampshire
• Northern Arizona University
• University of Kentucky
• West Virginia University
• University of Arkansas
• Louisiana State University-Alexandria
• Texas Tech University
• University of Pittsburgh
• Princeton University
• University of Georgia (as recently as Friday evening)

John Cohen, executive director of the program for countering hybrid threats at the Center for Internet Security and former acting undersecretary for intelligence at the Department of Homeland Security, said analysts determined most incidents were conducted by a single group based on tactics and technology used.

Group called ‘Purgatory’ behind campus swatting hoaxes: Report

“Purgatory is a loosely affiliated group of individuals who engage in swatting, targeting schools, targeting other locations across the U.S.,” Cohen said. “Our analysts at the Center for Internet Security assessed that most of these events were being conducted by a single group, and that group was, in fact, Purgatory.” 

The group has claimed responsibility for the attacks and often livestreams the calls to attract new members and additional business from foreign intelligence services, criminal organizations and terrorist groups.

“The direct reference to the library, we found that to be common across a big chunk of these calls. And secondly, the simulated gunfire in the background, that was something else we saw that was present in a number of calls. The callers used a specific commercial voiceover internet capability,” Cohen said.

The FBI confirmed it is investigating the hoax threats but declined to comment specifically on Purgatory when asked. In a statement, the bureau said it takes “potential hoax threats very seriously because it puts innocent people at risk.”

Most calls were made to university libraries

These cybercriminal groups have become highly sophisticated, using internet-based technologies and commercial services to hide their locations and identities, Cohen said. 

They can make calls appear local while operating from overseas, and use artificial intelligence to make threats sound realistic with background noises and sound effects.

Jennifer Doebler, a former FBI agent, said the bureau will likely “treat swatting investigations similarly to crimes against children online,” attempting to “introduce undercover agents to online networks to track and identify perpetrators.”

The groups typically operate on platforms such as Discord and Telegram, which make it easy to disguise identities.

“So Purgatory falls under the umbrella of an organization called the calm. The calm is an organization made up of cybercrime actors. They engage in many different types of criminal activity, including financial crimes, crimes against children, sextortion, as well as swatting,” Doebler said.

Cybercriminals use AI, tech to hide overseas to realistic calls

The perpetrators are typically young people in their teens and 20s, Cohen said. 

They “relish in the fact that they’re able to elicit a large-scale police response” and “enjoy the fact that people are scared.”

However, swatting is “highly dangerous,” not benign, Cohen warned.

Law enforcement responds believing they’re facing a real active shooter situation, creating risks for first responders and people at target locations while diverting resources from actual crimes.

Cohen noted that between swatting calls by this group, an actual mass shooting occurred at a school in Minneapolis.

“Any delay can mean people die,” Cohen said, explaining that doubts regarding emergency response because authorities must determine if calls are legitimate could prove fatal during actual emergencies.

Currently, there is no specific federal law that swatting violates, requiring prosecutors to use charges such as wire fraud and providing false information to law enforcement to build cases. 

Many perpetrators also operate outside the United States, requiring international cooperation for arrests.