Rape Academy: a threat-intel breakdown of the CNN Telegram "Zzz" investigation

#threatintel #osint #cybersecurity #security

Content warning. This article analyses a criminal network built around sexual violence against sleeping/unconscious victims. No graphic content. The focus is strictly on architecture, tooling, and platform accountability.

TL;DR

On March 26, 2026, CNN published an investigation by Vandoorne, Fox, Kennedy, Stubbs, and Chacón on a Telegram group called "Zzz" — roughly 1,000 men exchanging instructions on how to drug their partners, record the assaults, and monetize the recordings. I extracted the operational architecture: a Motherless attractor funnel, a Telegram C2 channel, crypto payment rails, a Luxembourg legal shell (Kick Online Entertainment S.A., fined £800k by Ofcom in February 2026), and a regulator publicly refusing to rule on illegality. An arrest was made in Poland on April 9. A deplatforming petition was filed on April 17. This post breaks down every layer.

The funnel

[Motherless attractor]   20,000+ videos tagged #passedout, #eyecheck
         │
         ▼
[Comment-section bridge] recruiting pathway into Telegram
         │
         ▼
[Telegram 'Zzz' C2]      ~1,000 members, instructions + coordination
         │
         ▼
[Crypto payment rails]   $20/viewer livestreams with real-time direction
         │
         ▼
[Legal shell]            Kick Online Entertainment S.A., Luxembourg

This wasn't steganography. It was SEO.

Why it survived

Telegram's "AI-assisted moderation" did not flag a group of that size for months.
Motherless operates behind a Luxembourg registration that decouples liability from the US-user base.
Ofcom, when fining Kick £800k in February, explicitly stated that deciding on illegality is the platform's job, not the regulator's.