Home U.S. Church Feds charge ‘Purgatory’ cybercriminal in swatting attack on Pope Leo’s alma mater

Feds charge ‘Purgatory’ cybercriminal in swatting attack on Pope Leo’s alma mater

by Gina Christian
A pillar is visible in front of St. Thomas of Villanova Church on the campus of Villanova University near Philadelphia March 11, 2021. Federal authorities charged a juvenile affiliated with the "Purgatory" cybercriminal group in the August 2025 swatting attack on Villanova University, Pope Leo XIV's alma mater, which interrupted an outdoor Mass amid an active shooter hoax. (OSV News photo/CNS file, Chaz Muth)

PHILADELPHIA (OSV News) — Federal authorities have charged a juvenile with a hoax that prompted an August 2025 active shooter scare at Villanova University, disrupting an outdoor back-to-school Mass at Pope Leo XIV‘s alma mater.

U.S. Attorney David Metcalf of the Eastern District of Pennsylvania announced April 30 that an unnamed juvenile — a “self-identified member” of a cybercriminal group known as “Purgatory” — will be prosecuted for “a rash of swatting calls” targeting several universities and institutions last August.

“The defendant selected the victim institutions at random and was not affiliated with any of those institutions,” Metcalf’s office said in its press release.

“Authorities have found no evidence that this individual was ever on campus, or that there were ever plans for an actual attack on the University,” said David G. Tedjeske, the school’s associate vice president of public safety and chief of police, in an April 30 message to the Villanova University community shared with OSV News.

Incident targeting Villanova ‘a cruel hoax’

Tedjeske noted that the incident “prompted the largest police response to campus the University has ever seen.” 

Under the Juvenile Delinquency Act, the juvenile’s identity, along with court records and information related to the case, cannot be publicly disclosed, said Metcalf’s office.

Swatting, named for the law enforcement acronym SWAT (special weapons and tactics), entails the false reporting of an emergency situation to draw first responders to a targeted location, creating fear and confusion.

“Perpetrators frequently place swatting calls to harass rivals or to raise their profile within their online communities by demonstrating a willingness to cause havoc and terrorize unsuspecting victims,” said Metcalf’s office in its press release.

Along with doxxing — broadly exposing a victim’s personal contact information to harass or intimidate —  the practice has “increased significantly” since 2024, while evolving into “sophisticated, technology-enabled tools of harassment, coercion, and public endangerment,” according to an Aug. 12, 2025, article published by the National Association of Attorneys General.

Villanova University — the Augustinian-run school where the future Pope Leo XIV received his undergraduate education — was marking its annual opening day for new students on Aug. 21, 2025, which included an afternoon Mass followed by a family picnic.

The university alerted students at about 4:30 p.m. that day of an active shooter on its suburban Philadelphia campus, with school officials advising its community to move to a secure location and lock or barricade doors.

Amid the active shooter alert, some 15 to 20 people took shelter in the main building of the Augustinian Province of St. Thomas of Villanova, which is located across the street from the campus.

Less than two hours later, Villanova University’s president, Augustinian Father Peter M. Donohue, advised that the threat, which drew multiple law enforcement agencies in response, had been a “cruel hoax.”

“While that is a blessing and relief, I know that today’s events have shaken our entire community,” he said in response.

Swatting of two universities traced back to online extremists

Swatting calls “waste valuable resources for local police departments and first responders who are responsible for responding to the calls believing there is an actual and immediate threat,” said Metcalf’s office.

“The perpetrators are often part of online cybercriminal communities and believe that they will not be caught or punished. They are wrong,” said the office in its press release. “Federal law enforcement will investigate and prosecute these crimes regardless of who commits them or where they reside.”

Marc-André Argentino, a senior researcher at Public Safety Canada who studies online violent extremism, wrote in an Aug. 25, 2025, analysis that both the Villanova hoax and one at the University of Tennessee at Chattanooga were the work of “Purgatory,” part of the larger Com Group of online extremists, which includes the child and youth sextortion group 764.

The Com, short for “The Community,” is “a primarily English speaking, international, online ecosystem comprised of multiple interconnected networks whose members, many of whom are minors, engage in a variety of criminal violations,” according to a July 23, 2025, FBI public service announcement. 

Argentino also pointed out in his analysis that while the Villanova and University of Tennessee hoaxes were in progress, Purgatory was “hosting a Discord Stage, where five of their members,” led by a member named Gores, “in front of an audience of 41 individuals, were streaming their successful attempts at swatting” the two universities, as well as “their attempts at swatting individual victims of the Com Network.”

Criminal services related to the Com Network

He described Purgatory as “a service-for-hire in the Com Network, where you can pay $20 to have them swat an academic institution.”

Argentino noted that Purgatory “formed on Telegram and Discord, using shared scripts and VOIP (voice over internet protocol) tools to mask identities and make coordinated false emergency calls to provoke armed police responses.”

The group also offers “offline criminal services such as bricking” — rendering an electronic device useless — “and slashing,” he wrote.

Argentino added it is “very possible these offline services are carried out through the Murderous Vile Kult, which is run by Gores,” and which “is a Com group that focuses on extortion and real-world criminality.”

In his message, Tedjeske commended the emergency response to the swatting attack as “swift and effective,” while noting the university had worked to “identify lessons learned” and “recommend improvements to our internal systems.”

“I know this incident made for a deeply difficult and unsettling beginning to the academic year for many,” he said. “It is my hope that sharing this information now offers some measure of clarity, reassurance, and a sense of closure as we continue to move forward.”

Gina Christian is a multimedia reporter for OSV News. Follow her on X @GinaJesseReina.

You may also like