Advancing Response to Sadistic Online Exploitation in Networked Youth Environments

What is sadistic online exploitation?

SOE represents a shift in how risk and harm manifest for some young people in digital spaces worldwide. It often triggers rapid, acute crises for young people. SOE differs from other forms of child exploitation. Beyond child safety concerns, it often involves elements of extremism, cybercrime, self-harm, and high levels of coercive control. This breadth of harm makes it challenging for professionals to respond.

How is sadistic online exploitation different?

• NETWORKED
  SOE occurs within online communities that exploit many platforms. They often identify through specific group names (such as 764, CVLT, and NLM), branding, and iconography.
• YOUTH-DRIVEN
  Young people are both victims and participants harming others. Both situations serve as entry points for participating in the groups.
• ACCELERATED
  These violent online networks encourage and reward harmful behaviors. This competition for status rapidly escalates the severity of abusive outcomes.
• MULTIDIMENSIONAL
  Child sexual exploitation, and sexual extortion in particular, is one of the many abusive tactics used within these networks. Other outcomes include self-harm and encouraging suicide, animal cruelty, vandalism, targeted violence, and more.

These unique features of SOE make it difficult to understand the size and scale of the threat. They have also created significant hurdles in responding to SOE.

What new insights about sadistic online exploitation did Thorn uncover?

1. Sadistic online networks are social conditioning environments

SOE groups socialize youth to cause harm. Continuous exposure to violent and exploitative rhetoric and content is foundational. New members often become desensitized to violence and begin to participate in the exploitation of others to gain acceptance and achieve status within the group.

Victimization within these groups often follows recurring patterns. Initial engagement typically begins with targeted grooming. This is followed by a request for content, usually involving a demeaning “task,” such as self-generated CSAM or self-harm content. It may also include minor nonsexual criminal activity. This content is then used against victims to ensure compliance with ongoing abuse and subsequent requests.

Viewing SOE networks as social conditioning environments helps explain why they are so harmful. The social dynamics within them put young people at risk at an earlier stage and in more embedded ways. Current interventions rely on detecting CSAM or credible threats of violence. By the time these indicators surface, the harmful socialization process is well underway.

2. Sadistic online exploitation networks blend many types of threats

SOE combines elements of child sexual exploitation, coercive control, extremism, cybercrime, and offline violence in ways that haven’t been seen before. Most professionals focus on only one type of threat at a time, which makes it difficult to understand the full scope of a single case, let alone the full picture of an SOE network.

Different professionals use different terms:

• NIHILISTIC VIOLENCE or NIHILISTIC VIOLENCE EXTREMISM
• VIOLENT ONLINE NETWORKS or GROUPS
• THE COM
• Specific group names like CVLT, 764, IRL COM, NLM, and more.

Many areas of professional expertise haven’t yet figured out how to combine their knowledge bases to assess this threat holistically. This means that SOE investigations and assessments are often incomplete because they only focus on one area of harm. Some aspects of SOE get overemphasized or missed altogether.

3. Current response systems are not organized in ways that enable disruption

SOE cases are typically identified through the existence of illegal content or activity. Based on the type of content initially detected (for example, CSAM or credible threats of violence), the case is routed to a designated unit with expertise in that threat type. This happens at all levels of response. Platforms that detect content route reports to designated internal teams focused on that type of content; reporting bodies are established to intake specific types of content; and law enforcement has dedicated units for investigating specific types of cases, such as crimes against children or counterterrorism.

Because SOE networks perpetrate many types of harms across different areas of expertise, a complete intelligence picture gets splintered within the response.

SOE detection is complicated because their behaviors do not consistently meet enforcement thresholds. Platforms might detect signs of coercive self-harm, psychological abuse, or non-ideological violence, but don’t combine these into a broader pattern of risk. This is especially true if illegal content remains undetected. As a result, these SOE activities often go unreported and unacted upon.

4. Coordination of information sharing and response across key institutions is not backed by formal governance

Without supportive forms of formal governance to coordinate collaboration among key players, the ecosystem’s response remains persistently outmatched. Many different groups are involved in responding to sadistic online exploitation, but each only sees a small part of the problem. For example, platforms see user behaviors, reporting bodies see reported content, law enforcement investigates reported cases, and support services provide trauma-informed recovery pathways for victims and families.

While all of this information is useful, it is not well-connected across the system. There are no effective systems in place to enable and ensure these groups share information or coordinate their efforts. This results in fragile forms of progress that struggle to scale.

5. Institutional incentives discourage system-wide changes

Groups and organizations with a stake in SOE network disruption are each focused on their own goals. Their organizations are judged on how well they do their specific job, and their performance against that determines things like funding and resourcing. At present, no institution is measured against how well it works with others in pursuit of collective progress. For example, platforms are evaluated against policy enforcement and user engagement, while law enforcement focuses on building cases they can prosecute. While these are not mutually exclusive actions, they are not shared goals.

This pursuit of independent institutional outcomes means that current gaps in collaboration are reinforced. In practice, institutional efforts to operate across these boundaries are often delayed, deprioritized, unsupported, or actively discouraged. Instead, response actors across sectors are incentivized to “stay in their lanes,” defaulting to actions that are clearly authorized, measurable, and defensible within their own institutions.

Without shared metrics, operationalized through defined governance mechanisms that orient towards collective impact, success for one institution does not translate into success in another, and promising efforts often lose momentum due to lack of “return” or continued investment.

How can the ecosystem work together to better protect children?

This research gives us three response horizons to disrupt SOE and create safer online spaces. Each reflects a key area of impact on the life cycle of threat disruption. No one organization can tackle the challenge of response in isolation. Many of the necessary tools, capabilities, and areas of expertise already exist across the ecosystem. The primary challenge ahead is in intentional adaptation and collective coordination.

Earlier risk identification and detection

• Help parents, educators, and other adults better recognize early warning signs and behavior changes. (See “What are the warning signs of sadistic online exploitation?” in the FAQ section below.)
• Establish responsible media reporting that informs the public without increasing harmful group-status dynamics linked to notoriety.
• Add more safeguards within online spaces commonly used for recruitment.
• Train frontline professionals to better recognize links between digital behaviors and exploitation risks.

Unify system response

• Equip specialized responders with SOE-specific assessment models for evaluating risk.
• Expand platform detection to act on patterns to enable enforcement against harmful networks.
• Shift towards intelligence-driven information sharing across SOE cases.
• Build and fund coordinated, hybrid response units, like dedicated taskforces and multidisciplinary response teams.

Build long-term capacity

• Develop programs for SOE-impacted youth that offer prosocial alternatives capable of replacing the warped sense of belonging that violent online networks provide.
• Recognize and support others affected, like families of victims or youth exhibiting problematic behaviors, and professionals exposed to this harm.
• Invest in upstream prevention to reduce the overall pool of vulnerable youth.

Frequently Asked Questions about sadistic online exploitation

Why we are researching sadistic online exploitation

Cases of SOE are increasing across the globe, however, the full scale of victimization remains unknown due to limited awareness and challenges in detection. While other areas of research have focused on understanding SOE group dynamics, it became clear from Thorn’s role within the ecosystem that this is not only a new threat but one that is straining legacy approaches to how we organize response efforts. With the extreme nature of this threat, delays in response are having dire consequences for victims.

Our research identifies how this threat interacts with and evades current response systems, thereby supporting the immediate needs of those on the front lines. We’re focused on identifying systemic gaps in response as they relate to these violent online networks affecting youth.

Research Methodology

Thorn’s insights were made possible based on the following sources:

• Information from law enforcement, NGOs, industry, and clinicians
• Interviews with 35 practitioners across 8 different countries
• Review of more than 50 sources

Download and share this report on sadistic online exploitation

One of the best ways to protect kids online is to stay aware, educated, and to share information with other caring adults. To learn more about violent online networks affecting youth, download the research report and share it with others.

Download the Report

How to cite this report

If you’d like to reference information from the report, our preferred citation is:

Thorn. (2026). Advancing Response to Sadistic Online Exploitation in Networked Youth Environments. https://info.thorn.org/hubfs/Research/Thorn_SOEResponse_Report_2026.pdf