Analysis of the panel dump puts receipts at roughly $2.3m over the five months it covers, with the operators retaining about twenty per cent — on the order of $456,000 — and the remainder going to affiliates.
For comparison, the figure this corpus recorded at 25-0227 was at least $107m traced to Black Basta over roughly two years. The two numbers are not measuring the same thing, and the difference is still worth sitting with.
Why They Are Not Comparable, Stated First
The $107m is chain-traced across an entire operation over about twenty-two months. The $2.3m is drawn from one panel covering a lower-tier programme over five. Dividing one by the other produces a ratio that means nothing.
This desk states that before drawing anything from the figure because the comparison is the obvious thing to do with it and is the wrong thing to do with it.
What The Twenty Per Cent Is
It is a franchise fee. The operators supply the encryptor, the panel, the leak site and the brand; the affiliate supplies the intrusion and keeps the larger share. The structure is the reason the corpus has repeatedly found that dismantling a brand does not remove capability — recorded at 25-0218, where an operation dissolved and its technique carried on.
A fifth of $2.3m is not a business that supports a large organisation. Whatever LockBit was at its peak, the part of it visible in this dump is a small commission operation.
And It Puts A Number On Something The Corpus Has Only Asserted
The concentration files at 25-1108 and 25-1109 record that a handful of brands account for most claimed victims. Claimed victims are leak-site postings, which are advertisements.
This is the first case in the database where a brand’s posting volume and its actual receipts can be looked at side by side, and they are not proportionate. A leak-site count is a measure of publication, not of income.
Financial figures are as reported in published analyses of the panel dump, listed below; this desk has not examined the dump or reproduced the analysis. The receipts figure covers only what the dump records, which is understood to be a lower-tier affiliate programme over roughly five months, and is not a measure of the operation’s total income. The comparison with 25-0227 is explicitly not a like-for-like ratio. Graded medium. Corrections: corrections@forensicpost.com.