Leaders, administrators, moderators and speakers. For the São Paulo Civil Police, Brazilian groups that groom and extort children online operate with a structure similar to that of criminal factions like the PCC (Primeiro Comando da Capital) and CV (Comando Vermelho): rigid hierarchy, clear division of tasks and thousands of members spread across different platforms.
"It is a well-established chain of command. That is why, when adults are involved, investigations are handled by the Money Laundering and Criminal Organization Court," delegate Lisandréa Salvariego Colabuono, head of Noad (Digital Operations and Articulations Unit), explains to Folha.
The comparison with organized crime goes beyond the organizational chart: there is internal promotion, coordinated action and absolute control of interactions. "There is a role for each member," she says.
Contrary to what many parents assume, the Discord platform is not the starting point. "It is the end of the line. This child was groomed long before," Lisandréa warns.
Recruitment usually begins on popular online games, such as Roblox, Minecraft and Free Fire, as well as social media and messaging apps, where the first contacts occur, and some of them may be disguised as online romances.
Once trust is established, victims share photos and personal data and find themselves trapped in a web of blackmail: sextortion.
Under threat of having their photos leaked, they are coerced into producing more content, in a desensitization process that escalates to self-mutilation, sexual exploitation and extremist content.
The accounts in the case files accessed by this reporting are striking in their cruelty: a 12-year-old girl was induced to cut the word "blood" into her skin; a teenage girl was forced to mutilate herself live on a video call watched by the group; another was coerced into inserting sharp objects into her body.
The victims identified in this portion of the case file come from at least three states in two different regions of the country: Mato Grosso, Goiás and Piauí.
A portrait that reinforces the Civil Police's warning: the problem is not concentrated in a single location and can affect families in any state in Brazil. The recordings then circulate in galleries (smaller servers, generally on Discord, created to store and display this material).
Country and Infinity, for example, are Telegram communities with thousands of participants, active at least between March 2024 and January 2025 — the period during which the São Paulo Civil Police documented the crimes analyzed in the case file, until launching Operation NIX, which arrested the leadership of Country.
The identified administrators are Brazilian, from at least four states: Santa Catarina, the Federal District, Rio de Janeiro and Minas Gerais.
Discord centralizes day-to-day operations — moderation and urgent matters — while Telegram and Signal ensure encrypted communication among leadership.
At the other end, the repository is located on the dark web, on sites such as a child sexual exploitation streaming platform that amassed 1.8 million registered users.
Folha reached out by email on Friday morning (24th) to Discord, Telegram, Signal, Roblox, Mojang Studios (Minecraft) and Garena (Free Fire) regarding the use of their platforms in these investigations, questioning them about moderation, grooming prevention and cooperation with authorities. Discord was also questioned about the Country and Infinity groups. There was no response by the time this report was published.
Financial machinery
Behind this lies a financial mechanism that connects game currencies, SaaS subscriptions (a recurring payment access model), privacy-focused cryptocurrencies, and the illegal data market.
According to criminal defense attorney Hélio Ramos, monetization is not limited to traditional currencies: in games like Roblox, Robux itself (the virtual currency) becomes a trading asset. "They sell Robux credits in WhatsApp and Instagram communities and within the game itself — a perfect niche, with a captive audience," he says.
On dark web platforms, the model operates on demand and through subscriptions to restricted rooms. "The monetization moves millions in crypto assets — not just through the sale of material, but by charging fees to join private rooms where data is traded and 'mega packs' containing child pornography [the term child sexual exploitation is used], zoophilia, and necrophilia are exchanged," Ramos explains, noting that these image databases fuel new extortion schemes.
The money is concealed via blockchain, Bitcoin, Steem Coins, fintechs in tax havens, and peer-to-peer exchanges to be converted into cash beyond the reach of authorities. International operations, such as the one that shut down a child sexual exploitation streaming network, have already seized hundreds of thousands in crypto assets.
For Ramos, the migration of crime to the digital sphere is a one-way street: "It carries far less physical risk than using a weapon on the street, and it comes with lighter sentences under current legislation."
Despite the financial figures, the motivation is not solely monetary — it is a triad of money, power, and notoriety. "We have encountered broadcasts with audiences of 600 to 800 people. There is financial gain, but above all a pathological pursuit of status," says the detective.
To intimidate victims, the groups resort to doxxing — the leaking of personal and family data. "When they demonstrate that they know where the victim lives or goes to school, the impact is immediate and devastating."
Bottlenecks
Authorities face technical bottlenecks: "The Federal Police have excellent teams, but they are small relative to the volume of cases. Perhaps 1% of the Military Police and 5% of the Civil and Federal Police are equipped to audit this infrastructure," says Ramos, advocating for greater integration among the police forces.
Data from the Brazilian Public Security Forum illustrate the scale of the problem: records of the production and distribution of child sexual abuse material surged 176.7% between 2021 and 2025, with 34.2% of perpetrators being teenagers; cyberbullying cases jumped 67.3%, which drove the passage of the Digital ECA in 2025, holding platforms accountable for preventing risks to minors.
NOAD has already mapped more than 1,900 targets and participated in more than 600 arrests. The detective warns: "People picture a teenager isolated in their bedroom. That is not what we are dealing with. We are confronting organized structures, with hierarchies, division of tasks, and thousands of active members operating online."
This outlet contacted the Federal Police by email on Friday regarding digital criminal organizations. There was no response before publication.
