During the festive season between Christmas Eve and New Year’s, a new wave of swatting incidents targeted nearly a hundred public figures, including prominent politicians and law enforcement authorities. Among the victims were U.S. Homeland Security Secretary Alejandro Mayorkas, Cybersecurity and Infrastructure Security Agency Director Jen Easterly, as well as Republican figures such as Representative Marjorie Taylor Greene of Georgia and Senator Rick Scott of Florida. Court documents later indicated that one of these fraudulent calls resulted in a serious car accident.
This time, the orchestrator behind these swatting events was identified as a figure known as Torswats. U.S. prosecutors allege he facilitated the operation by supplying personal information—such as names, addresses, and phone numbers—to two individuals, aged 21 and 26, from Serbia and Romania. These accomplices reportedly executed the swatting scheme based on scripts provided by Torswats.
In one particularly alarming incident, a caller identifying himself as “James” phoned in a report claiming a murder had taken place at the home of Georgia State Senator John Albers. He alleged that he had shot his wife and taken a man hostage, demanding a ransom and threatening imminent violence if his terms were not met. This scenario underscores the alarming nature of swatting, which can have devastating consequences for both intended targets and unintended victims.
Meanwhile, an investigation led by the FBI took a significant turn when an agent named Phillips reached out to a source named Dennis, indicating a plan to apprehend Torswats. The strategy involved getting Torswats’ father to the local police station to retrieve seized computers. During this time, Phillips suggested that Dennis revive an old persona to engage Torswats in conversation, effectively delaying him to buy time for law enforcement to execute an arrest. Despite Dennis’s illness with COVID-19, he consented to participate in the plan.
What transpired next deviated from expectations; Torswats accompanied his father to the police station, where authorities made a stealthy arrest. However, Dennis’s illness overshadowed the milestone of Torswats finally being taken into custody.
The FBI and the Justice Department declined to comment on inquiries regarding the protracted timeline of Torswats’ arrest despite having prior knowledge of his identity and having conducted searches on his residence. As the investigation unfolded over nearly two years, Dennis discovered the suspect’s name: Alan Filion. The revelation came with the image of Filion—a tall young man with long brown hair and a seemingly innocuous look, which contrasted dramatically with the serious nature of his supposed crimes.
At the time he was arrested, Filion was just 17 years old, a far cry from the 15 years he was when Dennis began his pursuit. Filion’s background suggests he was heavily immersed in online communities, lacking significant in-person social connections during the pandemic. After graduating early from high school, he went on to pursue a mathematics degree, albeit without leaving a strong impression on his professors.
Allegations surface indicating Filion may have been involved in efforts to incite violence and procure weapons for mass shootings. An anonymous tip to the FBI suggested connections between the Torswats account and a neo-Nazi group known as the Order of Nine Angles. The informant believed these activities were part of a larger scheme to disrupt social stability.
Within the context of this event, the MITRE ATT&CK framework can be applied to analyze the tactics potentially employed. Initial access techniques such as phishing may have been involved in compromising potential targets’ defenses, while persistence tactics could explain the coordinated execution of such widespread swatting campaigns. Additionally, privilege escalation methods could be inferred if attackers accessed secure government communication systems, facilitating the target identification process.
Overall, this incident serves as a sobering reminder of the digital threats that persist, underscoring the importance of robust cybersecurity measures for public figures and individuals alike, as malicious actors continue to exploit vulnerabilities for their own ends.
