Two arrests at a laundering service. Intrusion capability is replaceable; banking relationships that move criminal proceeds are not.
Four vendors, one campaign. Largest attack surface, least visibility, highest trust — and both states and criminals use the same door.
Two in five notifiable breaches involve nobody attacking anything, and sit outside everything this database has to say.
Geopolitical exposure is additive, not substitutive. It does not displace ordinary criminal risk — it sits on top of it.
A government buying physical parts it does not want, because a criminal group encrypted a third company’s systems.
Criminal activity does not scale thirtyfold in a year. Reporting does.
Where disclosure is not mandatory, criminal forums become the primary public record — and affected people learn from researchers.
Somebody looked at the population of people who wanted to run ransomware, decided it was larger than the population who could, and built a product for the difference.
A chat archive is people talking. A panel dump is records — generated by the operation for its own use rather than asserted to anyone.
An operation that runs on rotas, subscriptions and payment disputes does not require exceptional people. That is what makes it reproducible.
Applying the rule to a ransomware leader is the case that tests whether it is a rule or a preference. If it only holds for sympathetic subjects it is not a rule.
“Group X has been dismantled” is the form the good news usually takes in this field. It describes the destruction of the cheapest component.
The operation describing itself, to itself, with no expectation of being read. Nearly everything else in this corpus is an attacker described from outside.
The last four digits cannot buy anything. They are what the call centre asks for.
Espionage succeeds by producing no artefact. The ones in this corpus are the ones that failed at the last step.