What to know about ‘Purgatory’, the group behind the USC active shooter hoax

A juvenile allegedly associated with a cybercriminal organization will face charges for the USC active shooter hoax that happened months ago.

Back in August, reports of an active shooter on campus at the Thomas Cooper Library were completely fabricated by this individual, who has not been publicly identified because of their age, according to a press release from the U.S. Attorney's Office in Pennsylvania, which announced the charges.

Following the fake report, the campus was immediately placed on lockdown, and students were instructed to find shelter, even though there was no real gunfire. Students were escorted to safety once law enforcement detected no threat.

The same individual is allegedly responsible for a series of swatting hoaxes in 2025, across multiple college campuses in the U.S.

They didn’t act alone, and they didn’t have any reported connection with USC, reports say. The cybercriminal group that allegedly backed the juvenile is known as ‘Purgatory,’ and they purposely cause chaos for profit.

Here’s what you should know about the group and how they operate:

What is ‘Purgatory,’ and what do they do?

Purgatory is a loosely affiliated cybercriminal group that is responsible for the wave of fake active shooter threats targeting universities across the United States in late 2025, according to an intelligence report from the Center for Internet Security.

South Carolina’s Attorney General Alan Wilson called it an “online gore-seeking group” that picked USC and other institutions at random, the U.S. Attorney’s Office said.

The group started swatting schools on Aug. 21 at the University of Tennessee at Chattanooga and Villanova University, where students were gathered for a start-of-school Mass that turned to chaos before authorities realized it was a hoax, according to an article from NewsNation, which spoke with John Cohen, the Executive Director of the Program for Countering Hybrid Threats at CIS.

Purgatory has claimed responsibility for the attacks and often livestreams the calls to attract new members and additional business from foreign intelligence services, criminal organizations and terrorist groups.

Most members are young

Even though swatting is very illegal, harmful and dangerous, most members of Purgatory are in their teens and 20s.

“They relish in the fact that they’re able to elicit a large-scale police response, and enjoy the fact that people are scared,” Cohen told NewsNation.

Their members usually operate on social media platforms, such as Discord and Telegram, which makes it easier to hide their identities.

Calls are made to campus libraries

Purgatory figures that the easiest way to cause mass panic among students is to report a shooting in the most relaxing and quiet place on campus: The school library.

Using highly sophisticated, internet-based technologies and commercial services to hide their locations and identities, members make calls that appear local while operating from overseas, and use artificial intelligence to make threats sound realistic with background noises and sound effects.

“The direct reference to the library, we found that to be common across a big chunk of these calls. And secondly, the simulated gunfire in the background, that was something else we saw that was present in a number of calls. The callers used a specific commercial voiceover internet capability,” Cohen said.

This story was originally published May 5, 2026 at 3:24 PM.