Analyses of the panel dump report Chinese organisations as the most frequently targeted, ahead of the United States, Taiwan, Brazil and Turkey.
This is the single most useful thing in the leak, and it is useful because of what it is: a list of targets kept by the attacker for operational reasons, not a list of incidents that entered the public record.
The Corpus Has Been Arguing This From The Outside For 500 Files
At 25-0502 this desk set out the routes by which an incident becomes publicly known — a disclosure obligation, collective redress, a research industry with reason to publish, publication in English, and later a securities listing at 25-0924b. Every one favours the same handful of jurisdictions.
The argument was always an inference. If the record is shaped by disclosure regimes, then jurisdictions without them should be under-recorded relative to what actually happens. Nothing in the public record could test that, because the test requires a list that was never filtered through disclosure.
This Is That List
An affiliate panel records who was attacked because the operation needed to track it. No notification law, no regulator and no journalist stands between the event and the row.
And the resulting geography inverts this database. The corpus recorded Latin American coverage as thin at 25-1117 and applied the same discount to its own regional counts at 25-0718 and 25-0711. It has almost nothing on Chinese or Taiwanese victims for this period, and on this evidence that absence is not because little happened.
Why The Targeting Skews That Way Is A Separate Question
Reporting has cited affiliate remarks suggesting Chinese organisations were seen as easier to compromise and more likely to pay. This desk paraphrases rather than quoting: the remarks are from pseudonymous accounts in a criminal system, and reproducing them as quotation would lend them a precision the source does not support.
Whether the perception was accurate is not established by anything here. What is established is that it shaped where the attacks went.
The Limits, Which Are Severe
One panel, one lower-tier programme, roughly four months, one operation. Nothing here shows that global ransomware targeting has this shape, and a corpus that generalised from it would be repeating the mistake it has spent 500 files documenting.
What it does show is that at least one attacker’s own record disagrees sharply with the public record for the same window. That is enough to make the coverage claim at 25-0502 something better than an inference, and not enough to make it a measurement.
Victim geography is as reported in published analyses of the panel dump, listed below; this desk has not examined the dump. Affiliate remarks about targeting preference are paraphrased rather than quoted, deliberately: they come from pseudonymous accounts and this desk cannot verify who wrote them or in what spirit. The findings are bounded by one lower-tier programme over roughly four months and are not a description of global ransomware targeting. Graded medium. Corrections: corrections@forensicpost.com.