The cybergroup known as “purgatory,” is behind the horrifying fuss of AI-enhanced swatting calls on university campuses, with experts urging authorities to keep up with “internet speeds.”
Between August 21 and August 25, at least 10 universities across the United States were in chaos after fake active shooting game Call closed campuses to armed federal and local law enforcement agencies and introduced students to full-scale panic.
The call is then linked to Purgatory, a group of cybercriminals who use AI tools to recreate the sounds of screams and gunfires in calls with local authorities.
Purgatory, which primarily organizes telegrams and discordant platforms, comes from a larger group known as “The Com.” It is a loose cybercrime network engaged in the distribution of swatting, sext molecules and child sexual abuse materials.
The FBI issued an alert about COM in late July.
“sometimes [the call’s] John Cohen, executive director of the Internet Security Center's counter hybrid threat program and a former Homeland Security official, told the Post.
“Sometimes, frankly, that's because they enjoy the thrill they're watching.”
Hoax can pocket $95 in school swatting, a deliberate, gradual call to bring law enforcement to non-existent crime scenes, like recent media reports. Wired reported last month that the threat of $20 was previously paid.
The group's leader claimed that Rengoku had made $100,000 since the turbulent shooting began, the outlet said.
The fake call began on August 21, with reports of active shooters at the University of Tennessee Chattanooga and Villanova University, triggering an armed law enforcement response, sending students and parents who were panicked during the orientation event.
On August 24th, a group-linked swatting call was also held at the University of South Carolina and UNC-Chapel Hill.
Then, a whopping six swatting calls were made on August 25 alone, targeting universities such as Iowa, Kansas, the University of Maine, and the University of Arkansas.
“It's meaningless.”
Matt Mills, police chief at the University of Arkansas police station, recalled that a swatting call for active shooters at the school's Mullins Library threw campus into mayhem that day.
“The first call came just before 12:30. The caller said he was in our library and there was a man in the room with a gun,” he explained.
“The call came in for a few minutes towards the end of the call, allowing the dispatcher to hear the gunshots in the background.”
Local, city, state and federal authorities rushed to the scene. Campus students and staff barricaded in office buildings and classrooms, Mills said.
“Over the next few hours, we received over 300 calls from various parties on non-emergency lines and 38 911 calls. These calls ranged from anywhere.
After clearing seven campus buildings for officers, authorities determined that the Active Shooter Alert was an offensive call.
“So the initial response thankfully didn't hurt anyone, and I'm somewhat unhappy with the amount of resources deployed from at least 15 different agencies in our area, including federal agencies and state police,” Mills said.
When asked if he could understand why anyone would call or make a call, Mills said he couldn't “calculate” the reason why someone would do something like that.
“It doesn't make sense to me why someone pays to do this because they're on campus, in hospitals, anywhere.
How law enforcement can stop university swatting
Cohen, a cybersecurity expert, said foreign terrorist organizations, military and criminal organizations are “inconsistent” and aim to undermine US institutions, often employing groups like Purgatory to engage in targeted swatting businesses.
This call can be made from individuals within the group who are about to rise from subsequent media coverage.
“It's not just the disgruntled individuals sitting in their basement at home who say, 'I'm going to hack this college' or 'I'm going to call this college',” Cohen said.
“It's also foreign intelligence agencies, military, criminal organizations and even terrorist groups who say that part of my purpose is to cause disruption in the US or sow discord, undermine confidence in the government and undermine trust in the system.”
Cohen said it is not immediately clear who made or paid the phone at the 10 universities, but trend analysts have noticed an increasing influence on foreign and organized crime groups in Purgatory's operations.
This group uses a virtual private network known as “VPNS” and uses Google's voice numbers to fake the call coming from a local area.
Swatting a call is never “benign” and can be extremely dangerous.
“They aren't just irritated. In some cases, they may be intended to harass or cause confusion on the recipient, but when a swatting call comes, it can be very dangerous as law enforcement may respond like a real emergency,” he said.
“AI is used to simulate shootings in the background. Swatters monitor radio traffic in response agencies and fine-tune the phone accordingly,” he continued.
“So they're going to elicit a strong response from law enforcement because they believe they're responding to an emergency, a real emergency. So their aim is to get to the scene as quickly as possible, find a shooter for the case of an active shooter, and disable that shooter.”
To prevent future attacks, law enforcement officials need to evolve to detect possible hoaxes in real time, Cohen said.
“Criminal and threat actors are evolving their tactics at the speed of the internet. Unfortunately, law enforcement is still operating in dialogue,” he added.
“We need to be far better at understanding how foreign intelligence agencies, terrorists and criminals use the power of the Internet. We need to adapt our investigation process accordingly,” Cohen urged.
Another tactic to stop members of Purgatory is to “identify, arrest and prosecute” members, but Cohen pointed out that they take certain “technical capabilities.”
Purgatory Members – Evan Strauss, 26, Owen Jalbeau and Braden Grace, both ages 18, were charged last May with calling targeting housing, high schools, casinos and Albany International Airport, between December 2023 and December 2024 and December 2024, according to a statement from the Department of Justice.
One of the 18-year-olds who was thought to have played a leadership role in the group was briefly listed on the FBI's most wanted list prior to their arrest. All three then pleaded guilty.
The University of Arkansas and several other universities targeted by the Swatters continue to investigate false reports.
The FBI told the Washington Post it was investigating the incident, and the agency told the agency “we are seeing an increase in swatting at events across the country and taking the threat of potential hoax very seriously, as it puts innocent people at risk in a statement from the New York Times.”
When asked if the spree would continue, the leader named “Gore” said, “Yes, two months.”
The FBI did not return requests for comment from the post when it was published.
