Tacloban shooting may be first 'completed' attack by 764 extremist network — expert
MANILA, Philippines — The Tacloban school shooting may be the first mass shooting the online extremist network 764 carried out to completion anywhere in the world, a cybersecurity expert told senators on Wednesday, July 1.
Angel Redoble, chair of the Philippine Institute of Cyber Security Professionals, shared his assessment at the Senate panel's first hearing on the June 22 attack at San Jose National High School in Tacloban.
The same hearing also saw the Philippine National Police (PNP) disclose that it has rescued at least 24 minors part of the same broad online network since October 2025. Five of the children rescued were found to have harmed themselves.
"The first completed mass shooting, if we can finally attribute that to 764, that will be the first," Redoble said. "Because in 2025 [in the United States], it was not completed. It was prevented [and] was foiled."
764 is an extremist network that's been flagged by the US Federal Bureau of Investigation as a "tier one" threat. The group uses blackmail and manipulation to coerce minors into self-harm and explicit acts. It typically operates in decentralized platforms like Discord and Telegram to exploit minors on a global scale.
Whether the Tacloban attack is the network's first completed shooting remains unproven, and Redoble and other authorities present at the inquiry stressed repeatedly that the link to 764 was not yet confirmed.
Redoble told the committee his earlier research had pointed to groomers of the network mainly based abroad. But that was until foiled attacks in Marikina and Laguna suggested recruiters of 764 were already operating inside the country.
When news of the Tacloban shooting broke, he said, his first questions were whether the attackers were gamers and whether the case was tied to 764, both of which, he said, appeared to hold up.
Pressed by Senate President Sherwin Gatchalian on whether such groomers were already active in the country, Redoble pointed to a comment left on the Facebook page of one of the Tacloban suspects after the shooting, in which the user told the boy his footage had been edited and told him to delete his accounts.
Redoble was referring to the comment of a certain "Sedykh Ryazanov" on one of the Facebook posts of the teenage gunman given the alias "Nash." A screengrab shown by Sen. Risa Hontiveros during the hearing shows that the user wrote: "Na-edit na kita boy sa TikTok. Make sure na-delete mo ang Discord, Reddit, Telegram para walang evidence mahanap."
The accounts have since been deactivated, Hontiveros said.
"That will confirm that we have a local player, a groomer or a recruiter that's operating in our own cyberspace," Redoble said. "Before we had patterns, but today I think we can say that we already have this players, and I don't think that guy is alone. I think there's more."
Schools have no way of knowing how many of their students play games heavily or are being groomed, he said, and authorities should assume local recruiters are active.
How the grooming works
764 changed its own rules in 2025, Redoble said, after a leadership shake-up inside the network.
A recruit once had to produce child sexual abuse material to get in. Now, Redoble said the group demands proof of real-world violence.
That rule, he said, is what turns groomed children into attackers.
The predators or groomers also worked in stages, where they would first identify a vulnerable minor, befriend them, then cut them off from family before pushing them toward self-harm or an attack.
"It's not the online game," Redoble said. "It's the perpetrators or the predators in the game that's really changing our children."
He named three "hunting grounds" where recruiters look for children: mental-health support chats, online games, and a TikTok subculture built around Gothic fashion that draws teenage girls.
Games including Roblox, Minecraft and Gorebox are where children are first spotted, he said, with the platforms' own recommendation systems steering vulnerable users toward one another.
24 minors rescued from network since October
At least 24 minors have been rescued by the police from the same broad network since October, the PNP's anti-cybercrime group said during the hearing.
Police Col. Richmond L. Tadina of the PNP's anti-cybercrime group said all 24 are part of the "True Crime Community."
"We have identified No Lives Matter and the 764 network as subcultures. They are under the True Crime Community," Tadina said.
"What is common is there is coercion, self-harm, exploitation of minors, and violence," he added.
Five of the 24 minors rescued had "resorted to inflicting harm on themselves," Tadina said, due to their exposure to gore, including on the game GoreBox.
Police were able to stop those 24 children from carrying out violence on others, he said.
"So na-prevent po namin 'yung 24 minors to carry out violence," Tadina said. "However, it's sad to note that itong recent shooting is hindi natin na-prevent."
The Cybercrime Investigation and Coordinating Center has temporarily blocked Gorebox, a physics-based sandbox game, which one of the Tacloban suspects played heavily.
The Germany-based developer, Felix Filip, declined the committee's invitation to appear on Wednesday, telling the Senate panel by email that the game is rated 18+ and "not intended for, or directed at, minors."
Hontiveros called the hearing to examine gun access, the police response to the Tacloban shooting and how online platforms are used to groom and radicalize children.
It followed the committee's April inquiry into online radicalization, which pushed Roblox to tighten its safeguards for young users in the Philippines.
- Latest
- Trending
