Man found with indecent images linked to an online group that blackmailed teenage girls faces sentencing in May

A 21-year-old East London man has been convicted in a shocking online child exploitation case—caught with indecent images and tied to a criminal network preying on teenage girls through blackmail.

The National Crime Agency investigated Richard Ehiemere from Hackney following a referral from Discord in January 2021, when he was 17 years old. The online platform raised concerns about the activities of the CVLT group, to which Ehiemere was connected.

CVLT is classified as a ‘Com’ network, typically comprised of young males who share harmful and misogynistic content while committing various online offences. Members attempt to gain status within these groups by committing or encouraging increasingly shocking or harmful acts.

The investigation determined that an online profile “Retaliate#1337” had logged onto Discord channels connected to CVLT 383 times. This account disclosed stolen email addresses and passwords, known as ‘combo lists’, and is also believed to have shared indecent images of children.

NCA investigators traced these logins back to Ehiemere’s home in Hackney, where he was arrested in April 2021 with assistance from the Metropolitan Police Service.

Upon seizure, his mobile phone was found to contain 29 indecent images of children, ranging from category A (the most severe) to category C. The device also stored conversations related to hacking, selling unlawfully obtained material, and techniques to avoid detection.

Investigators discovered a computer tower containing 142 combo lists, each filled with personal details that had been stolen and could have been used to defraud victims. Multiple accounts and software associated with VPN providers—used to mask a user’s location—were also found, including “ExpressVPN”, “NordVPN”, “MullvadVPN” and “OpenVPN”. Evidence showed “ExpressVPN” and “MullvadVPN” were used to access the Retaliate account when sharing stolen credentials.

The broader CVLT network targeted girls on social media platforms such as Discord. Members used online aliases to communicate and manipulate victims into sending intimate photos. They threatened to ‘dox’ their victims—revealing real-world identities and publishing personal information online—to coerce compliance with their demands.

The group employed a disturbing methodology: one member would persuade victims to send intimate images, either through coercion or consent. This material would then be used by the wider group to blackmail the victim into sending increasingly extreme content.

In particularly concerning cases, girls were forced to join group calls where they would be instructed to perform sexual acts and self-harm for their audience. Some vulnerable victims were even encouraged to attempt suicide on camera.

Following a seven-day trial, Ehiemere was convicted by a jury at Aldersgate Nightingale Court on 25 February on two fraud offences and three charges related to indecent images of children. He is scheduled for sentencing at Snaresbrook Crown Court on 1 May.

Steve Laval, Senior Investigating Officer at the NCA’s National Cyber Crime Unit, described Ehiemere as “a key enabler for this harmful online group, providing stolen data which they could use to defraud hundreds of victims.”

Laval emphasized the danger of networks like CVLT, noting they are “built on extremist or misogynistic ideologies and promote violence against women and girls, who are forced to comply with their extreme demands through fear.”

He added that the NCA and policing authorities are committed to reducing the threat posed by these networks through collaboration with industry to identify groups, pursuing members or associates, and raising awareness among parents and educators to help identify deviant behaviour.