Threat Actor Profile: Kirk Mafia, an Emerging Swatting-as-a-Service Threat

Key Takeaways

• Crossing Cyber and Physical Domains: Kirk Mafia advertises its services across platforms such as Telegram, then uses people located in the area of their target to carry out the physical attack, which is typically a form of swatting. 
• Group Naming: The Charlie Kirk branding of the group is assessed to be based on the post-ironic memes of “Kirkification,” and does not indicate alignment with any specific political ideation.
• Service-Based Harassment: Kirk Mafia offers tiered pricing for swatting services, charging $85 for targets in any country at their cheapest tier. Beyond swatting, the group also promotes its Violence-as-a-Service offering, with services including violent physical harassment.
• Increased Tempo: Kirk Mafia has claimed responsibility for over 30 swatting incidents since the beginning of February 2026, several of which caused significant public disruptions and law enforcement response.
• “Big Game” Targets as Promotion: The group repeatedly targets popular livestreamers as a tactic to build notoriety and promote their services.
• Extortion Model: Beyond paid swatting attacks, the group engages in direct extortion, forcing repeatedly targeted high-profile individuals to pay a fee in exchange for ceasing harassment, and to avoid having their families and friends targeted.

Actor Overview

Kirk Mafia is an emerging threat actor group focused on high impact, physical-world harassment facilitated through digital platforms. Harassment tactics include Violence-as-a-Service and swatting, which is an illegal hoax where a major incident such as a hostage situation or bomb threat is called in on an individual. The goal is for a major response from law enforcement that leads to the target’s home being damaged or possible injury to that individual.

Based on observed activity, Dataminr assesses a connection between Kirk Mafia and the predominantly English-language cybercrime ecosystem known as “The Com.” Other groups connected with The Com have also been known to take part in violence-as-a-service operations including swatting and threatening individuals. The group operates primarily on Telegram, with operations characterized by:

• Tactics: The group claims to use “actors,” likely with voice changers or region-accurate accents, for hoax phone calls to create more “convincing” and “insane” responses, aiming for maximum damage such as doors and windows of targeted residences being destroyed. Observed chatter also suggests sound effects are used on live calls to further convince responding law enforcement organizations of authenticity.
• Targeting: The group’s targets are primarily streamers and other high-profile internet personalities, though this is a promotion tactic with evidence of other lower profile targets in the US and UK. They have also impacted public venues including theme parks, schools, malls, and other retail establishments. The group seems to treat perceived disrespect from internet personalities as a pretext for swatting.
• Streamer Extortion: Kirk Mafia leverages social media harassment as a precursor for attacks. Once they attempt to swat a target, they sometimes offer a “one-time deal” or extortion payment demand to the target or their manager. They explicitly state they have existing agreements with streamers who are no longer bothered after paying the group for “whitelisting.”
• Crowdsourced Harassment: Kirk Mafia encourages its followers to engage in the livestream chats and Discord servers of targeted streamers, both to boost notoriety and increase pressure to encourage extortion payments.

Actors and Motivation

Kirk Mafia is a financially motivated group, primarily composed of two threat actors, that has been active since at least December 2025. Their activity and tempo escalated in February 2026 when the group claimed responsibility for an increasing number of swatting incidents targeting multiple high-profile streamers.

• Utilman (@utilman777) – Claims to be located in Sweden
• Sharp (@SharpKM)

The Charlie Kirk branding of the group is assessed to be based on the post-ironic memes of “Kirkification,” rather than alignment with any specific political ideation. The group has cultivated multiple streams of financial income via its paid swatting service, Violence-as-a-Service, and extortion against streamers.

Historically, targets have primarily been US-based, with responsibility occasionally claimed for incidents in other countries such as the UK, Canada, and Israel.

Dataminr Detections

Dataminr has detected multiple swatting incidents linked to Kirk Mafia across at least five US states. 

February 17: Incident in Franklin, TX, multiple school campuses were placed on lockdown following bomb and shooting threats.

February 25: Dataminr detected Kirk Mafia stating it would target streamer iShowSpeed in a swatting attempt.

March 11: Two separate swatting incidents targeting California-based streamers, one causing disruptions at a theme park in Anaheim, and another at a mall in Arcadia, CA.

The group has also previously claimed it attempted to trigger a swatting incident at the 2026 Super Bowl.

Dataminr continues to observe the group’s evolving service structures, including expanded Violence-as-a-Service offering. Additionally, it is likely there are further incidents not publicly claimed by the group, with claimed swatting attempts typically serving as a promotional tool or to establish credibility via testimonials from customers.

Recommendations

Considering Kirk Mafia’s tactics, it is important for organizations to look at this from both a cyber and physical security perspective. As such, Dataminr’s recommendations on how to manage the risk associated with groups like this will cover both domains. 

• Implement Anti-Swatting Protocols: High-profile individuals and corporate executives should register with local law enforcement’s “swatting” or “emergency registry” programs where available, to maximize situational awareness when responding to public safety situations.
• Establish Law Enforcement Liaisons: Organizations in the entertainment and retail sectors should reinforce direct lines of communication with local law enforcement and federal programs related to swatting.
• Monitor Chatter, Plan for VIPs: Security teams should monitor threat actor chatter across digital platforms related to high-profile personnel, and implement contingency planning.
• Awareness: Train personnel on swatting TTPs utilized by threat actors, including the use of “actors,” leveraging of VoIP numbers, sound effects mixed into live calls, and other techniques designed to trigger maximum law enforcement response.