Allison Nixon

Early Career and Research Focus

Allison Nixon began her cybersecurity career around 2011, working the night shift in the security operations centre at Dell SecureWorks. While her colleagues focused on state-sponsored hacking groups, Nixon independently began investigating the online forums and communities where criminal hackers congregated. This early work cultivated her distinct research focus on the motivations and social dynamics of cybercriminals, rather than solely their technical methods. In 2013, while employed at Integralis, she presented at the Black Hat USA conference on techniques for bypassing DDoS protection services, and she subsequently joined the business risk intelligence firm Flashpoint, where she served as Director of Security Research before moving to her current role at Unit 221B in early 2020.

Key Investigations and Contributions

Nixon's investigative work has been instrumental in several high-profile cybercrime cases. Her research often bridges the gap between technical data and law enforcement action, providing crucial attribution that leads to arrests. In October 2016, while at Flashpoint, Nixon led the investigation into a series of massive distributed denial-of-service (DDoS) attacks against DNS provider Dyn, which disrupted access to major websites including Amazon, Twitter, and Spotify. Her team confirmed the involvement of the Mirai botnet in these attacks, and Nixon's ongoing research contributed to the law enforcement investigation that culminated in the December 2017 guilty pleas of the three creators of the Mirai malware, with her work on this case featured in a Wired cover story by journalist Andy Greenberg.

Nixon has published extensive research on The Com, a loosely affiliated network of predominantly young, English-speaking cybercriminals, which she began tracking as early as 2011. The group is responsible for a wide range of offenses including social engineering, SIM swapping, cryptocurrency theft, sextortion, swatting, and ransomware attacks. Following the September 2023 cyberattacks on MGM Resorts International and Caesars Entertainment by a group associated with The Com called Scattered Spider, Nixon provided expert analysis to media outlets including the Wall Street Journal and TechCrunch. She has characterized these groups as Western, predominantly young cybercriminals who deliberately recruit minors due to more lenient legal consequences, and in a June 2025 presentation at Sleuthcon, she described The Com as a youth subculture drawn in by financial incentives and peer influence.

At Unit 221B, Allison Nixon built eWitness, an invitation-only platform aggregating scraped data from Telegram and Discord channels used by Com members. This platform is shared with other researchers and law enforcement agencies. It aids in tracking the criminal activity of The Com network. Nixon began tracking the online communities from which The Com emerged as early as 2011.

The 2024 Snowflake Breaches and Moucka Case

In April 2024, Allison Nixon became the target of death threats posted on Telegram and Discord by a person using the handles 'Waifu' and 'Judische.' The person was later identified as Connor Riley Moucka, a Canadian national. Moucka was accused of involvement in data breaches targeting customers of Snowflake, a cloud data platform, and of extorting victims for millions of dollars in Bitcoin. After the threats drew her attention, Nixon and Unit 221B, working with Mandiant and other partners, helped to identify Moucka's real identity, which was passed to law enforcement. Connor Riley Moucka was arrested in Kitchener, Ontario, in October 2024 and faces 20 federal charges in the United States.

Media Appearances and Public Profile

Allison Nixon has been featured in numerous media appearances. She appeared on 60 Minutes in a 2024 segment on Scattered Spider and its connection to casino cyberattacks. Nixon was featured in The New York Times Presents episode 'The Teenager Who Hacked Twitter' in 2020. She also appeared in the documentary series Most Wanted: Teen Hacker in 2025. In February 2026, MIT Technology Review published a feature profile on Nixon detailing her career.

• A 2024 segment on the CBS news program 60 Minutes discussing Scattered Spider.
• Featured in the 2020 FX documentary The New York Times Presents: "The Teenager Who Hacked Twitter".
• Appeared in the 2025 documentary series Most Wanted: Teen Hacker.
• Cited extensively in reporting by cybersecurity journalist Brian Krebs on Krebs on Security.
• Profiled in a major feature in MIT Technology Review in February 2026.
• Appeared in a May 2026 episode of the Wired web series "Tech Support".

Her media appearances span television, documentary film, and print journalism. Nixon has been cited in reporting by Brian Krebs at Krebs on Security on topics including Mirai and SIM swapping. In May 2026, she appeared in an episode of the Wired web series 'Tech Support' to answer questions about cybersecurity. These appearances reflect the broad interest in her cybersecurity research and investigations.

Research Methodology and Impact

Nixon's research methodology is distinguished by its anthropological approach to cybercrime. Instead of focusing purely on malware code or network signatures, she investigates the online social spaces where criminals meet, communicate, and form communities. This involves monitoring forums, Telegram channels, and Discord servers to understand relationships, hierarchies, and recruitment patterns, with the eWitness platform she developed being a tool born from this methodology that systematically collects and organizes data from these sources for analysis. The impact of this work is measured in both disrupted criminal operations and advanced understanding, with FBI officials cited in MIT Technology Review crediting her work with contributing to the identification and arrest of more than two dozen cybercriminals since 2011. Her research provides critical intelligence that helps corporations and law enforcement anticipate the tactics of groups like The Com, moving beyond reactive defence to a more proactive stance against evolving cyber threats.

Criminal Activities Attributed to The Com

Allison Nixon has published extensive research on The Com, a loosely affiliated network of predominantly young, English-speaking cybercriminals. The Com is responsible for a range of offenses including social engineering, SIM swapping, cryptocurrency theft, sextortion, swatting, and ransomware attacks. In a June 2025 presentation, Nixon described The Com as a youth subculture whose members are drawn in by financial incentives and peer influence. She noted that criminal activity within The Com escalates from financially motivated fraud to violence and sextortion.

• Social engineering attacks to gain unauthorized access to systems.
• SIM swapping to hijack phone numbers and bypass two-factor authentication.
• Theft of cryptocurrency from digital wallets and exchanges.
• Sextortion schemes involving threats to release private material.
• Swatting, which involves making false reports to trigger armed police responses.
• Deploying ransomware to encrypt data and demand payment.
• Major data breaches, such as those against MGM Resorts and Caesars in 2023.
• Operating DDoS-for-hire services and launching attacks.

This network has been linked to significant cyberattacks, including the September 2023 attacks on MGM Resorts International and Caesars Entertainment by Scattered Spider, a group associated with The Com. Nixon provided analysis on these attacks to media outlets including the Wall Street Journal and TechCrunch. She has characterized Scattered Spider and related groups as Western, predominantly young cybercriminals. These groups deliberately recruit minors due to the more lenient legal consequences they face.

Questions about Allison Nixon

What is The Com that Allison Nixon researches?

The Com is a loosely affiliated network of predominantly young, English-speaking cybercriminals responsible for offenses including social engineering, SIM swapping, cryptocurrency theft, and ransomware. Nixon began tracking its online origins as early as 2011. She describes it as a youth subculture where members are drawn by financial gain and peer influence, with criminal activity often escalating in severity. The group Scattered Spider, linked to the 2023 casino attacks, is associated with The Com.

What was Allison Nixon's role in the Mirai botnet case?

In October 2016, while serving as director of security research at Flashpoint, Nixon led the firm's investigation into a series of large DDoS attacks against DNS provider Dyn. Flashpoint confirmed the involvement of the Mirai botnet in the attacks. Nixon's ongoing research contributed to the law enforcement investigation that led to the December 2017 guilty pleas of the three creators of the Mirai malware. Nixon was a named subject in the resulting cover story by Andy Greenberg in Wired.

What happened in the Connor Moucka case?

In April 2024, Nixon received death threats online from a person later identified as Canadian national Connor Riley Moucka. Moucka was accused of involvement in data breaches targeting Snowflake customers and extortion. Nixon and her team at Unit 221B, with partners, helped identify Moucka, leading to his arrest in Kitchener, Ontario, in October 2024. He faces 20 federal charges in the United States.

Where has Allison Nixon appeared in the media?

Nixon has appeared on 60 Minutes in a 2024 segment on Scattered Spider. She was featured in The New York Times Presents episode 'The Teenager Who Hacked Twitter' (2020) and in the documentary series Most Wanted: Teen Hacker (2025). In February 2026, MIT Technology Review published a feature profile on Nixon. She has been cited in reporting by Brian Krebs and appeared in an episode of the Wired web series 'Tech Support' in May 2026.

What is eWitness?

eWitness is an invitation-only platform built by Allison Nixon at Unit 221B. It aggregates scraped data from Telegram and Discord channels used by Com members. The platform is shared with other researchers and law enforcement agencies. It is used to aid in tracking the criminal activity of The Com network.

Who is Allison Nixon?

Allison Nixon is a cybersecurity researcher and the chief research officer and co-owner of Unit 221B, a New York City based cybersecurity investigations firm. She is known for her research into DDoS attribution, cybercrime attribution, and English speaking criminal communities, particularly the loose cybercriminal collective known as The Com. Her investigative work has contributed to the identification and arrest of more than two dozen cybercriminals since 2011, according to FBI officials cited in MIT Technology Review. She began her career around 2011 working at Dell SecureWorks and later presented at Black Hat USA in 2013. Nixon joined Unit 221B in early 2020 and has been featured in major media outlets for her expertise.

Sources and further reading

• Allison Nixon (Wikipedia)
• Tag Archives: Allison Nixon (krebsonsecurity.com)
• Tracking Peter Stokes and The Com: Allison Nixon ... (zetter-zeroday.com)
• Allison Nixon on detecting threats and 'high-harm' actors (everythinginmoderation.co)

Checked by the Your Space Hamilton desk. Last updated 2026-10-31.