A child being threatened through a phone may be facing an entire group of people who want to watch the threats carried out. In criminal cases involving the online network known as 764, federal prosecutors have described communities where recordings of children being abused are collected, circulated and used to establish a member’s standing. The people responsible can gain recognition by persuading, threatening or coercing someone into increasingly severe harm. Children’s suffering becomes something other members reward.

Those cases have new relevance in Oregon as investigators examine the online activity of the teenager responsible for the October 15 shooting at Silver Rail Elementary School in Bend. OPB reports that federal and state investigators are exploring possible connections to violent extremist groups, including 764, and whether anyone online encouraged or helped plan the attack. Its reporting relies on four sources familiar with the investigation, including law enforcement officials. Those sources said investigators had not confirmed any co-conspirators, and the possible connection remains under investigation.

For families grieving in Central Oregon, that distinction deserves care. The existence of these networks does not establish their involvement in the Silver Rail shooting, and the cases described below do not explain the gunman’s motive. They do, however, document a form of abuse that parents may never have encountered or imagined. Guilty pleas, prison sentences and investigations across several countries show that people communicating from behind screens have caused serious harm to children far beyond their own homes.

What is known about the teenager behind the attack

Bend Police identified the gunman as 16-year-old Griffin J. John II, a former Silver Rail student who was not enrolled in Bend-La Pine Schools at the time of the attack. Police said he forced entry through glass doors and entered the classroom immediately to the left, where all six victims were shot. His previous attendance establishes a connection to the school, but it does not explain why he attacked it.

In our October 16 report on his background and the classroom, we covered the New York Post’s claim, attributed to law enforcement sources, that he deliberately sought out a room where he had received special education services. We also described reporting by The Times on a 2020 television interview in which his mother discussed his educational needs during pandemic school closures. Those accounts offer limited background on his childhood and school history. They do not establish that his educational needs caused the violence or that a particular grievance motivated him.

The question of motive remains unresolved in the public information reviewed for this article. OPB’s reporting raises a separate investigative question: whether someone online encouraged the attack or helped with its planning. That possibility is not a finding that 764 directed him, recruited him or coerced him. In its October 19 update, Bend Police said they were withholding additional details about the suspect and weapon while the investigation continued, and warned that misinformation was circulating. A reported choice of classroom and a possible online connection are leads to examine, not a confirmed explanation for the killings.

What is 764?

764 is a decentralized international network of online groups whose members exploit children and glorify violence. Participants include both adults and teenagers, and the abuse can involve grooming, sexual blackmail, the sharing of child sexual abuse material and threats intended to force victims into self-harm or other violence. It operates across online communities and private chats rather than as a single website. According to research by the Anti-Defamation League, the name now also serves as an umbrella for related groups and offshoots.

The network began in 2021 with Bradley Cadenhead, then a 15-year-old in Stephenville, Texas. Its name comes from the first three digits of that city’s ZIP codes, according to ADL. Members can gain standing by documenting the abuse they inflict or coerce, making a child’s suffering a source of recognition among participants. Understanding that structure helps explain the danger investigators are examining; it does not establish that the Bend gunman belonged to 764 or acted at its direction.

Much of this activity begins on familiar services. In its March 2025 public warning, the FBI described violent online networks using social media, gaming platforms and mobile applications to find victims, typically ages 10 to 17, with some as young as nine. The first contact can arrive through a place a child already visits to play, talk or find friends. Families do not need to picture a child deliberately seeking out a hidden website to understand how an approach could happen.

The term “dark web” can therefore give parents an incomplete picture of the danger. Investigators have identified activity on widely available platforms, including Discord and Telegram, while child protection agencies describe approaches through gaming and social spaces. A child can encounter someone through an ordinary interest before the conversation becomes private, intimate or threatening. Simply recognizing an app’s name tells a parent very little about the people contacting their child through it.

The FBI uses the term “nihilistic violent extremism” for some of these networks, referring to people who glorify violence and seek destruction or chaos. Their members’ motives can differ: sexual gratification, recognition, belonging and ideological beliefs can overlap. In February 2026, the FBI’s Boston office said the bureau was investigating more than 350 subjects nationwide, with all 56 field offices involved. That was a count of subjects under investigation at the time, not a count of convictions or victims.

Understanding the personal relationship is just as important as understanding the group’s name. An offender may first offer attention, reassurance or romance, becoming someone a young person believes cares about them. A child who feels isolated may value that relationship intensely, especially if the person appears to share their age or experiences. Once threats begin, the earlier affection can make it harder for the child to recognize what is happening or accept help.

The Royal Canadian Mounted Police describes a pattern in which increasingly compromising demands deepen a victim’s isolation. Offenders threaten to expose private material, contact a child’s family or school, or publish identifying information. They may also threaten false emergency reports that send police to a home, a practice known as swatting. A child can come to believe that complying with another demand is the only way to prevent something worse.

Some victims are then pressured into finding other children to target. Canadian authorities warn that young participants may themselves have entered these groups through exploitation, which complicates both prevention and intervention. A person approaching a child may actually be another teenager, rather than an adult pretending to be one. Investigators have to establish who directed the abuse, who acted under coercion and who knowingly harmed others, while protecting the children caught in it.

The extent of the problem is difficult to measure, but reports to child protection specialists offer a troubling indication. The National Center for Missing & Exploited Children reported more than 1,300 CyberTipline submissions with a connection to violent online groups in 2024, followed by about 1,000 during the first six months of 2025. These are reports, not a verified total of individual victims. The organization said both adults and minors appeared among the offenders, and the reported abuse included sexual exploitation, self-harm and threats against families.

A recent federal guilty plea shows how deliberately such abuse can be organized. On October 8, 2026, Prasan Nepal, a 21-year-old from High Point, North Carolina, pleaded guilty to conspiring to sexually exploit minors. The Justice Department identified him as a senior 764 leader and described criminal activity spanning 2021 through 2025. Authorities said the conspiracy involved at least eight minor victims, some as young as 13.

The prosecution’s account describes members collecting and trading records of abuse, with more severe material helping establish status. Nepal recruited and directed participants and enforced rules within the network, according to the Justice Department. The case also involved guidance for targeting vulnerable young people, including those struggling with their mental health. His sentencing is scheduled for March 5, 2027; the guilty plea establishes his admitted criminal conduct, while the punishment remains for the court to decide.

The case illustrates why describing these spaces only as disturbing discussion groups misses the conduct at issue. Prosecutors described people directing others, maintaining collections of abuse and rewarding participation. The recordings could serve several purposes at once: evidence of a member’s cruelty, material to share with others and another means of controlling a victim. An audience that values severe harm gives the person committing it a reason to keep going.

Another guilty plea makes that incentive particularly clear. In December 2025, Alexis Aldair Chavez of San Antonio pleaded guilty to racketeering and child sexual abuse material offenses. Federal prosecutors identified him as an administrator and leader of 8884, a group associated with the broader 764 network. Their account included coercing a child into a suicide attempt during a recorded video call to increase his standing among other participants.

The same prosecution described that victim later participating with Chavez in the coercion of another victim overseas. It is a deeply disturbing example of how exploitation can draw a young person into further abuse. The sequence also helps explain why a frightened child may hesitate to disclose everything that happened. A child who believes they will be seen only as an offender may remain under the control of the person who first victimized them.

There have also been substantial prison sentences. On November 7, 2024, Richard Anthony Reyna Densmore of Michigan was sentenced to 30 years in federal prison for sexually exploiting a child. Prosecutors described his role in building Discord communities connected to 764 and recruiting children through online gaming spaces. He used threats and blackmail to obtain recordings of sexual abuse, self-harm and violence.

Densmore’s case also showed offenders working together to obtain material from a child. According to the Justice Department, when a girl resisted his request, he enlisted another user to help secure an explicit recording. That detail matters because an abusive interaction may involve more than the account a parent initially discovers. Removing one contact can be an essential step, but a child may need help addressing threats, other participants and material already circulating.

The wider world surrounding 764 includes other networks with documented histories of child exploitation and encouragement of violence. Three names that appear in reporting and extremist research are CVLT, No Lives Matter and Maniac Murder Cult. Their relationships differ, and they should not be treated as interchangeable names for one organization. The cases below provide context about that wider threat; the sources cited here do not establish a connection between any of these three groups and the Bend shooter.

CVLT’s methods helped shape the abuse later associated with 764. The Anti-Defamation League traces that influence to the network’s use of sexual blackmail: offenders obtained sexual images or recordings of children, then threatened exposure to force them into further abuse. Each demand could leave a child more frightened of telling someone and more vulnerable to the next threat. According to ADL, 764’s founder adopted those methods and expanded them to include coercion into self-harm and other violence.

This month, a criminal case in Paris brought CVLT’s treatment of children into a courtroom. Rohan Rane, identified as a leader of the network, received a 20-year prison sentence on October 9 after being convicted of sexual extortion and acts of torture against a minor, the Associated Press reported. Children in the United States, Britain and Canada had been targeted through Discord, according to the report. Because the proceedings involved child victims, the trial took place behind closed doors.

In Sweden, reporting on No Lives Matter documented violence carried out on neighborhood streets and circulated online. An October 2024 investigation by Swedish public broadcaster SVT verified recordings of eight attacks in Stockholm’s Hässelby area, including two stabbings. The videos circulated through Telegram spaces associated with 764, including a channel called NLM-764 Sweden, and were used in material promoting the network. Several people shown being attacked appeared elderly and physically vulnerable.

SVT also traced online accounts to a boy who was 14 at the time of the suspected stabbings. Posts associated with his online identity claimed that he ran an NLM cell. The investigation showed how assaults in one neighborhood could become promotional material for people watching from elsewhere in the world. The journalists also drew a clear boundary around their findings, distinguishing the eight verified recordings from other footage they could not independently locate.

Maniac Murder Cult, also known as MKU, MKY or MMC, promotes racist and neo-Nazi violence. One of its leaders, Georgian national Michail Chkhikvishvili, pleaded guilty in Brooklyn federal court on November 17, 2025 to soliciting hate crimes and distributing instructions for making bombs and ricin. The Justice Department described his efforts to recruit others online to attack Jewish people and racial minorities. One person he believed he was recruiting was an undercover FBI employee.

The admitted conduct included planning an attack involving poisoned candy and directing the undercover employee to target Jewish children and schools in Brooklyn. This was a plot investigated by authorities, not a completed poisoning attack. Prosecutors also documented the circulation of his material encouraging mass violence, including school shootings. The case shows how an online organizer can try to enlist someone else to carry out an attack against people who have never encountered him.

For Oregon readers, these examples help explain why investigators take online relationships seriously. They document distinct forms of harm, from sustained blackmail of children to filmed assaults and recruitment for racist violence. They do not resolve what happened before the Silver Rail attack or establish who, if anyone, influenced the gunman. Those answers must come from evidence in the Bend investigation.

Authorities outside the United States are confronting related dangers. In an October 6, 2026 announcement, the RCMP said an 18-year-old Saskatchewan resident had been arrested and charged with terrorism-related offenses following an investigation into alleged activity connected to 764. Police said the investigation began with a report about online conduct and involved Telegram and Discord. The charges are allegations, not convictions, and Canadian youth privacy protections limit what authorities can release about the accused.

Australia has established a specialized response to the wider problem. In October 2025, the Australian Federal Police announced Taskforce Pompilid, bringing together expertise in cybercrime, counterterrorism and child protection to address decentralized criminal networks exploiting young people. Authorities said their work with partners had contributed to nine international arrests and three domestic arrests. The announcement covered a broader network of criminal activity and should not be read as attributing every arrest to 764.

Australian investigators have also emphasized that money is not always the offender’s objective. Their warning about “sadistic sextortion” described offenders seeking recognition within groups through the harm they could cause, including cases involving young perpetrators. For a family familiar with scams demanding payment, that is a crucial difference to understand. An offender seeking control or recordings of cruelty may keep demanding more even when a victim has already complied.

A separate prosecution in Northern Ireland demonstrates how devastating online coercion can become across borders. In October 2024, Alexander McCartney received a life sentence with a minimum term of 20 years for offenses that included manslaughter, blackmail and child sexual abuse. The Police Service of Northern Ireland estimated that his offending involved approximately 3,500 victims in at least 30 countries. He impersonated young girls online to approach children and obtain material he then used against them.

One victim was 12-year-old Cimarron Thomas in West Virginia, who died by suicide in May 2018 while being subjected to his abuse. McCartney admitted manslaughter in connection with her death. The police account cited here does not establish a 764 connection, so his crimes should be understood as a separate case. They nevertheless demonstrate the real consequences of an offender controlling a child remotely, with an ocean between them.

These cases also expose the limits of advice centered entirely on strangers. Children need to understand that someone can become familiar, spend considerable time with them and still be dangerous. A person who knows their interests, remembers their worries or claims to love them can use that relationship to obtain compliance. Threats and coercion remain abuse even when they come from someone a child has trusted or still feels attached to.

For parents, the task is to make it possible for a child to disclose that relationship without expecting immediate blame. The FBI and Canadian authorities recommend ongoing conversations, familiarity with children’s online activities and calm responses to concerns. An opening might be asking whether anyone online has made them feel afraid, demanded secrecy or threatened to share something private. The answer may come gradually, especially when a child has been told that telling an adult will bring consequences.

Warning signs deserve attention in context. Authorities identify unexplained injuries, intense fear of an online contact, anonymous gifts, harassment directed at the household and abrupt changes in behavior among possible indicators. Withdrawal or a change in sleep, on its own, does not establish involvement with an abusive group. A parent who notices several concerning changes can seek help from a health professional, school support staff or law enforcement without first proving which network, if any, is involved.

There is also a responsibility beyond individual households. NCMEC noted that most of the violent-group reports it discussed came from members of the public, whereas technology companies submit most CyberTipline reports overall. The organization raised concern about platforms’ ability to recognize these crimes. Parents can talk with their children and adjust settings, but companies operating the services must also be able to identify and respond to coercion, threats and the circulation of abuse.

In Oregon, questions about platform protections are already being pursued separately from the Silver Rail investigation. OPB reports that the Oregon Department of Justice is examining whether Discord failed to protect minors despite its assurances about safeguards. That inquiry should not be confused with evidence that the company or a particular online group caused the Bend attack. Both investigations warrant scrutiny, and both require reporting that distinguishes established facts from questions investigators are still trying to answer.

Families who discover exploitation have places to turn. Suspected online child sexual exploitation can be reported through NCMEC’s CyberTipline, and the FBI’s Internet Crime Complaint Center accepts reports of internet-enabled crime. Account names, profile links, dates and threatening messages can help authorities understand what occurred; families should ask investigators how to preserve evidence safely rather than forwarding abusive images. If a child faces an immediate threat to their safety, call 911 and seek urgent help.

For intimate images taken before someone turned 18, NCMEC also offers Take It Down, a free service that creates a digital fingerprint of a file already on the person’s device. The image itself stays on that device, while participating platforms can use the fingerprint to identify matching material on public or unencrypted services. It cannot guarantee removal from every corner of the internet. NCMEC specifically advises users not to download, send or share an image to submit it to the service.

Bend families deserve verified answers about Silver Rail, including any evidence that other people encouraged the attack. Until investigators establish those facts, the documented cases elsewhere give parents a reason to begin conversations now, without treating every online friendship as a threat. A child needs to know that an embarrassing message, an image they regret or a demand they already obeyed does not end their right to protection. Whatever an offender has told them, they can still ask for help, and the adults around them can help them take that first step.