Ecosystem Disruption Playbook

OPERATOR SNAPSHOT

Mission. Sustained ecosystem degradation, not episodic takedowns. Success is measured by compounding friction over time: actors spending more on security and reconstitution, Russian institutions treating criminals as internal liabilities, protection relationships dismantled, ransom volume and operational tempo declining across multi-quarter windows.

The 4 Phases

Critical Do / Don’t Rules

SECTION 1 | PURPOSE & SCOPE

What This Document Is

This document proposes a framework for sustained disruption operations targeting the Russia-linked ransomware and cybercrime ecosystem, including the protection infrastructure (Russian state officers and institutional relationships) that insulates top-tier actors from enforcement. It is offered as analytic input for interagency partners with operational or analytic roles.

• A proposed phased framework for ecosystem-level disruption
• A strategic reference for pressure alignment across domestic Russian institutions
• A guide for avoiding engagement patterns that trigger protection reflexes
• A methodology for identifying and dismantling FSB officer protection relationships
• A tool and partner reference for capability targeting

What This Document Is Not

• A policy document or legal authority
• A replacement for agency-specific operational protocols
• A senior leadership orientation document: this is analytic input for operational planning
• A directive for operational units: analytic recommendations require appropriate authority before action
• A static product: it must evolve as the ecosystem adapts

This document draws on structural analysis of Russian agency behavior, observed enforcement outcomes, and analytic assessments of the ransomware ecosystem. Realpolitik incentives, not normative expectations, drive the analytical framework. Confidence is labelled only where a claim carries operational weight, using three levels. Confirmed means a primary source states it: a court record, a designation notice, an official release. Credible means consistent reporting from sources with relevant access, without a primary document. Analyst inference means the judgement is ours. Unlabelled text is background that is not in dispute.

Scope Limitations

Three categories of actor fall outside this framework's intended scope and should be flagged through separate channels if encountered:

• GRU-linked actors and wartime-absorbed criminal infrastructure. The GRU leverages criminal actors for military and geopolitical operations and maintains different protection dynamics than the FSB. More critically, actors who have been operationally absorbed into GRU or FSB wartime operations occupy a different legal and policy environment. This framework does not address them. Indicators of wartime state absorption (actors receiving operational tasking against NATO or Ukrainian infrastructure, or actors whose targeting patterns align with active Russian military objectives) should be flagged separately.
• Non-Russia CIS actors with independent state protection. This framework's institutional leverage points (FSB, MVD, FNS, CBR) are Russian. Actors operating under Kazakh, Belarusian, or other CIS state protection require jurisdiction-specific analysis. Note: Kazakhstan has functioned as an actual enforcement partner on specific cases and its enforcement dynamics differ meaningfully from Russia's, Kazakhstani actors without Russian state protection may be accessible through local law enforcement channels. Belarus is operationally equivalent to Russia (see Annex A). Other CIS jurisdictions require case-by-case assessment.
• SVR-linked actors. The SVR's relationship with the cybercriminal ecosystem is more limited than the FSB's but is not zero, particularly at the financial fraud and intelligence nexus. This framework does not address SVR-protected actors.

SECTION 2 | CORE THESIS

The Russia-linked ransomware ecosystem is resilient by design. Individual actors, infrastructure nodes, and even ransomware brands reconstitute quickly after episodic disruptions. Takedowns create friction but not degradation unless compounded over time.

Reconstitution runs on two clocks, and conflating them is the most common measurement error in this field. The node clock measures how long a function takes to be restored: a customer base moving from one bulletproof hoster to another, an encryptor reappearing on new infrastructure. It runs in days, and what it measures is displacement, not degradation. The brand and personnel clock measures whether an operation resumes at all, and it runs in months or never. Both are real. Only the second is evidence of degradation. Our own measurement of public pressure episodes reports node-level recovery in days while a substantial population of episodes has never closed at all, and that second population is where durable damage shows up. Every claim about reconstitution speed, in this document or any other, should state which clock it means. Confirmed, on our published series.

The correct strategic model is sustained cost imposition across multiple ecosystem layers simultaneously: financial, infrastructural, human terrain, protection layer, and domestic Russian institutional. When pressure is applied in coordination across these layers, actors face compounding costs that cannot be absorbed through simple reconstitution.

Scope qualification: the compounding friction thesis is structurally sound but rests on an assumption of sustained, coordinated multi-node pressure that has no confirmed historical precedent at this scale. The available evidence is consistent with the model while falling short of validating it. On-chain ransomware payments fell to roughly $820 million in 2025, down about 8 percent from roughly $892 million in 2024, and the victim payment rate reached a record low with non-payment at about 72 percent. Claimed attack volume rose over the same period rather than falling. That divergence is what partial implementation looks like: pressure is reaching the money and doing considerably less to the rate of attack. The thesis should be treated as an operational framework and planning model, not an empirically validated outcome. Confidence in the model's logic is high. Confidence that full coordinated execution is achievable within current interagency and allied coordination constraints is moderate. Analyst inference.

A critical layer absent from many disruption frameworks is the protection infrastructure itself. FSB officers who recruit, co-opt, and shield cybercriminal actors are not passive bystanders. They are load-bearing nodes in the ecosystem. Disrupting the protection relationship is as operationally important as disrupting the criminal infrastructure it shields.

Defining Success

• Increased operational friction: actors spending more time and money on security, reconstitution, and vetting
• Rising domestic risk: Russian institutions treating cybercriminal actors as internal liabilities, not tolerated assets
• Protection layer erosion: specific FSB officers and factions whose protection relationships become institutional liabilities
• Forced tradeoffs: criminal operations creating regime-level costs that cannot be ignored
• Measurable ecosystem contraction: victim counts, ransom volume, and operational tempo declining over multi-quarter windows

The strategic principles that follow govern all phases of this framework. Violating them (particularly the engagement triggers) consistently produces the opposite of the intended effect.

SECTION 3 | STRATEGIC PRINCIPLES

3.1 Lead with Domestic Harm Framing

Russian institutions respond to internal threats, not external ones. Cybercriminals must be reframed as threats to Russian financial stability, domestic public trust, and regime legitimacy, not as foreign adversaries. Framing that emphasizes geopolitical harms activates protection reflexes and is counterproductive. Confidence: CREDIBLE

• Emphasize harm to Russian citizens, businesses, and financial infrastructure
• Use tax irregularities, currency violations, and fraud charges (not cyber-specific charges) where possible
• Surface financial inconsistencies (lifestyle vs. declared income) through FNS referrals
• Avoid framing that allows actors to be cast as resisting foreign interference

3.2 Exploit Internal Contradictions, Including Within FSB

Russian agencies do not operate in unified alignment. The FSB, GRU, MVD, and FNS frequently have competing institutional interests. Effective pressure identifies and exploits these contradictions rather than seeking coordinated Russian cooperation, which is not achievable at the strategic level. Confidence: CREDIBLE

Critically, FSB itself is not a monolith. It contains competing factions, officers with divergent financial interests, and internal competition for political favor. The officer liability track (Section 9) rests on this reality: the goal is not to activate a unified FSB response, but to create conditions where specific FSB factions or leadership figures (who have their own institutional incentives) find it in their interest to act against a specific officer. This is a different and more achievable objective than FSB cooperation.

• MVD Department K has arrest incentives that FSB does not always override for mid-tier actors
• FNS modernization objectives can be leveraged to surface financial anomalies independent of RIS direction
• Rosfinmonitoring operates under Egmont obligations that create exposure even when political will is absent
• CBR 115-FZ creates non-attributable friction without requiring prosecutorial intent
• Within FSB: officers whose protected criminal assets have become attribution risks may face internal pressure from competing officers or factions, this internal friction is exploitable

3.3 Sequence for Minimum Backfire Risk

Actions that trigger protection reflexes (particularly public attribution and extradition requests) harden actor protection rather than undermining it. Pressure sequencing must account for this dynamic. Confidence: CREDIBLE

• Low backfire risk first: financial exposure, infrastructure provider pressure, underground trust node disruption
• Mid-risk second: domestic agency referrals through non-intelligence channels (FNS, MVD)
• Avoid triggering actions unless actor is already isolated from state protection
• Full backfire risk reference: Section 8

3.4 Measure Everything

Disruption operations without measurement become narrative. Every pressure action should have a defined expected effect and a mechanism for observing actual outcomes. Adaptation by actors is itself signal, log it. Confidence: CREDIBLE (as principle); implementation quality varies by resourcing

• Define expected effect before taking action
• Log pressure applied, observed response, and time-to-reconstitution for every major action
• Track ecosystem health KPIs on a recurring basis (see Section 11)
• Use adaptation patterns to predict next-state ecosystem behavior

SECTION 4 | PHASE FRAMEWORK

The four phases are sequential at ecosystem scale but overlapping at the actor level. Phase 4 (Sustainment) begins as soon as the first pressure actions are taken and never ends.

4.1 Phase 1: Ecosystem Mapping

Before pressure can be applied effectively, the ecosystem must be understood as an interdependent system, not a collection of individual actors. Mapping focuses on nodes, dependencies, choke points, and substitutability. The protection layer is a mandatory fifth mapping domain.

Financial Layer

• Wallet clusters and attribution: primary wallets, layering wallets, mixing endpoints
• Cash-out infrastructure: OTC brokers, crypto exchanges (VASP compliance gaps), payment aggregators
• Mule networks: recruitment patterns, geographic concentrations, lifecycle
• Front companies and laundering fronts: registration, banking relationships, beneficial ownership
• Anomalous outflows: payments that do not fit criminal operational cost profiles, these are protection payment candidates (see Section 9 and Section 10)

Key question: where do funds become fiat, and who touches them?

Infrastructure Layer

• Hosting and BPH providers: registrar, nameserver, ASN, upstream transit
• Domain infrastructure: registration patterns, DNS clustering, CDN/DDoS protection dependencies
• Payment acceptance: what payment rails accept criminal proceeds at each node
• Upstream dependencies: who hosts the BPH providers? Who sells IP space to the ASNs?

Key question: what is the minimum set of upstream providers whose removal collapses multiple downstream nodes?

Human Terrain

• Technical roles: malware developers, IAB operators, affiliate managers, crypters
• Governance and trust roles: escrow operators, forum administrators, arbitrators, reputation managers
• Financial roles: cash-out brokers, mule recruiters, accountants, front company directors
• State linkages: which actors have RIS recruitment history, krysha relationships, or prior enforcement contact?

Protection Layer

• Map which FSB officers or factions are actively handling, recruiting, or shielding which actors
• Document protection payment flows: anomalous outflows from criminal actor finances that represent krysha fees or bribe payments
• Identify protection relationship tenure: how long has the relationship existed, and has it ever shown signs of strain?
• Map officer personal financial exposure: Western assets, family holdings, real estate, business interests
• Cross-reference officer travel patterns against viable third-country arrest jurisdictions (Annex A)

Key question: for each protected actor, who is the officer or faction, what is the payment relationship, and what would make that officer a liability to FSB leadership or competing factions?

Substitutability Assessment

Substitutability is not a mapping output, it is a targeting input. Build substitutability assessments before disruption actions, not after. For each critical role:

• Identify the likely replacement actor within 30 days of disruption, name them, map them, pre-position pressure on them
• Assess recruitment pipeline depth: is the replacement pool thin (high substitutability cost) or deep (low cost)?
• For protection relationships: who is the backup officer if the primary is removed? Is there one? Absence of a backup officer is a high-value disruption indicator
• Document succession signals in underground forums: who is building reputation that positions them for role succession?
• Pre-position pressure on identified successors so disruption of the primary does not create a clean handoff

State Interaction Layer

• Map which Russian agencies are currently tolerating, exploiting, or suppressing which actors
• Identify actors without current state protection (highest-value disruption targets)
• Identify contradictions: actors whose behavior creates friction with agencies that could be activated
• Cross-reference against enforcement outcomes and known recruitment histories

4.2 Phase 2: Pressure Alignment

Alignment means identifying which levers work through which Russian institutions, sequencing referrals to exploit internal contradictions, and ensuring domestic framing is in place before any action is taken. The full Russian agency reference is in Section 7.

Priority Channels: Confidence CREDIBLE

• MVD Department K: mid-tier actors without active RIS protection; responsive to domestic harm framing and arrest metrics incentives
• FNS: financial exposure and lifestyle inconsistencies; no arrest power but feeds downstream enforcement
• Rosfinmonitoring: laundering infrastructure mapping; Egmont obligations create exposure pathways independent of political will
• CBR (115-FZ): non-attributable financial friction without prosecutorial threshold; disrupts infrastructure without targeting individuals

Secondary Channels, Confidence: CREDIBLE (conditional)

• FSB factions: reachable when a specific officer or faction has reason to act against a competing officer's protected asset, or when an actor has defied or embarrassed the service. Not reachable through standard channels. Reachable through manufactured liability (Section 9)
• SKR (Investigative Committee): activates only on elite political signal; not accessible through routine referrals
• Prosecutor General: downstream packager, not an initiator; useful for reframing charges once a case is politically elevated

Reframing Strategy

• Tax fraud and undeclared income, not hacking charges
• Organized crime (Article 210), applicable when group structure, hierarchy, and economic benefit are documented
• Harm to Russian citizens or financial stability, not Western victim framing
• Financial irregularities exposing political patrons, creates incentive for krysha relationships to weaken

4.3 Phase 3: Cost Imposition

Cost imposition operates across five simultaneous vectors. Actions within each vector should be sequenced from lowest to highest backfire risk and coordinated across vectors where possible.

Vector 1: Financial Pressure

• Wallet sanctions (OFAC/OFSI/EU): designate wallets with documented criminal attribution
• Exchange KYC pressure: engage VASPs with weak AML compliance; flag suspicious clusters
• Correspondent banking exposure: surface laundering routes that touch Western correspondent banks
• CBR referrals: flag suspicious domestic transaction patterns through Rosfinmonitoring-to-CBR pipeline
• OTC broker exposure: identify and designate key OTC nodes that serve as cash-out bottlenecks

Vector 2: Infrastructure Pressure

• Upstream provider engagement: registrars, hosting companies, DNS providers, CDN/DDoS services
• ISP and ASN notifications: abuse notifications to upstream transit providers for BPH-linked ASNs
• Takedown coordination: infrastructure seizures timed to financial actions to prevent emergency reconstitution
• Roskomnadzor friction: platform restriction requests that disrupt criminal communications channels

Vector 3: Legal and Non-Cyber Charges

• Tax and financial charges: work through FNS exposure to generate domestic enforcement basis
• Currency violations: undeclared foreign assets and illegal currency operations
• Article 210 (criminal organization): applicable when group structure, hierarchy, and economic benefit are documented
• Corruption and bribery: where krysha relationships involve documented payments to officials
• Drug and travel violations: non-cyber charges usable in third-country jurisdictions for arrest during travel

Vector 4: Underground Social Infrastructure

• Trust node disruption: escrow operators, arbitrators, and forum administrators are non-technical but ecosystem-critical
• Reputation system attacks: discrediting actors within underground markets creates internal friction
• Recruitment pipeline disruption: targeting mule recruitment networks raises operational costs
• Communication platform pressure: degrade Telegram channels and forums used for coordination
• Escrow and arbitration record exploitation: disputes between criminal actors and protection relationships surface in arbitration, these records contain protection payment documentation and officer contact methods

Vector 5: Protection Layer Pressure

Full methodology in Section 9. Summary:

• Anomalous outflow analysis: identify protection payment flows from criminal actor finances using the crypto-to-fiat methodology (Section 10)
• Officer financial exposure: map Western asset holdings, family financial relationships, lifestyle inconsistency, feed to FNS and investigative journalism channels
• Manufactured contradiction generation: surface officer-criminal financial relationships to FSB institutional awareness through non-attributable channels, exploiting internal factional competition, not seeking unified FSB cooperation
• Simultaneous officer + criminal network sanctions: batch designations that land on the officer and their protected network simultaneously, eliminating reconstitution window
• Third-country arrest development: pre-position legal frameworks in viable European jurisdictions for officers and former officers with documented travel patterns (Annex A)

4.4 Phase 4: Sustainment

Sustainment is not a final phase, it is a continuous operational posture. Disrupted ecosystems reconstitute unless pressure is reapplied to emergent nodes.

Reconstitution Monitoring

• Track infrastructure reappearance: new domains, ASNs, and hosting providers linked to disrupted actors
• Monitor wallet re-activation: new wallets receiving funds from known criminal clusters
• Track actor rebranding: name changes, new affiliate programs, forum re-registration
• Map role succession: who fills vacated positions in governance, financial, technical, and protection roles?
• Protection relationship reconstitution: does a disrupted actor acquire a new FSB handler? How quickly? Who is the new officer? Which faction?

Pressure Rotation

• Avoid predictable action patterns: actors adapt to anticipated enforcement rhythms
• Rotate pressure vectors: if financial actions become anticipated, shift to infrastructure or social pressure
• Exploit adaptation: when actors move to new infrastructure or financial rails, those new nodes become targets
• Reassess agency alignment: domestic institutional tolerance shifts over time; re-map quarterly

SECTION 5 | AFFILIATE STRATEGIC FRAMEWORK & RaaS-SPECIFIC DISRUPTION

The affiliate layer is the operational engine of the entire ecosystem. It has historically received less strategic attention than core leadership, a gap this section addresses. The framework below applies to both RaaS franchise operations and closed hierarchical groups.

5.1 Structural Comparison: RaaS vs. Closed Groups

5.2 Affiliate Strategic Framework, Both Group Types

Regardless of group structure, the affiliate layer shares common characteristics that make it a high-value strategic target.

Affiliate Prioritization

Affiliate Mapping Methodology

• Forum vetting history: RaaS affiliates are recruited through Exploit and XSS. Forum registration patterns, vouching relationships, and posting history build identity continuity packages
• Payment address clustering: affiliate payments from ransom proceeds follow predictable patterns, 70-80% splits are detectable in blockchain forensics; affiliate wallet clusters build over time
• Operational signatures: victim targeting patterns, negotiation style, ransom amount calibration, and deployment timing are affiliate-specific fingerprints that persist across group migrations
• Infrastructure reuse: affiliates reuse tooling, staging infrastructure, and C2 patterns across operations and across group migrations, these are identity continuity indicators
• Closed groups: internal communication leaks provide direct affiliate roster visibility; treat every seized or leaked internal dataset as a primary affiliate mapping source

Affiliate Migration Tracking

When a group is disrupted, affiliates migrate. Migration patterns are intelligence, they reveal which competing groups are absorbing talent, what the new operational tempo will be, and who the resilient actors are.

• Pre-position monitoring on likely recipient groups before takedown, not after
• Track forum re-registration and new vouching relationships in the 30 days following disruption
• Map operational signature reappearance: same targeting patterns and deployment timing appearing under a new group banner identifies migrated affiliates
• Migration speed is an ecosystem health indicator: fast migration (under 14 days) indicates high affiliate confidence in alternatives; slow migration indicates ecosystem-level friction

The Affiliate Arrest Multiplier Effect

A single well-chosen affiliate arrest produces effects that extend far beyond the individual:

• Immediate: removes operational capacity, disrupts active victim negotiations
• Intelligence: creates CI pathway toward core team; seized devices yield infrastructure and contact data
• Psychological: remaining affiliates do not know what the arrested affiliate has provided, uncertainty is operationally degrading independent of what was actually shared
• Recruitment: high-profile arrests chill new affiliate recruitment; the RaaS franchise becomes visibly dangerous to join
• Financial: affiliate payment flows seized or frozen impose direct cost on the core team's revenue stream

5.3 RaaS-Specific: Paths to Leadership Identification

5.4 Attacking the RaaS Business Model

Trust Destruction

• Law enforcement seizure of affiliate panels exposes affiliate identities and active operations, creating fear of exposure across the remaining roster
• Posting apparent evidence of compromise on the group's own infrastructure makes affiliates question whether the platform is burned
• Affiliates who doubt the core team's security migrate to competitors within days, you do not need to arrest the admin to empty the affiliate roster

Payment Rail Pressure

• Designate OTC nodes and exchanges that service RaaS admin wallets
• VASP engagement: flag high-volume criminal clusters for enhanced due diligence at withdrawal points
• Correspondent banking exposure: surface laundering routes touching Western banks
• This is the most durable pressure vector, infrastructure rebuilds in days; financial exposure compounds over time

IAB Layer Disruption

• IAB arrests and underground market disruption reduce quality access supply available to affiliates
• Rising IAB prices compress affiliate margins, reducing franchise attractiveness
• IAB disruption is low-backfire-risk, these actors are not typically state-protected assets

Decryptor Release

• Every publicly released decryptor reduces victim payment rates and undermines core franchise value
• Operation Cronos released 7,000+ LockBit decryption keys publicly
• Even the credible threat of decryptor release reduces victim payment likelihood during active negotiations

5.5 Preventing Reconstitution and Rebrands

• Document infrastructure fingerprints before takedown: panel code, ASN patterns, hosting behaviors, domain registration style
• Maintain malware attribution continuity: code lineage, developer artifacts, crypter relationships
• Immediate public attribution of new brand to prior identity resets brand equity to zero
• Pre-position sanctions designations to fire immediately upon rebrand identification
• If the same developer writes the new encryptor, the same artifacts will appear in samples, malware analysis on day-zero samples closes the attribution gap

5.6 Victim-Side Engagement Framework

The ecosystem has historically been approached from the supply side. Victim payment refusal is one of the most powerful ecosystem pressure mechanisms available, it directly attacks the financial incentive sustaining the entire RaaS model. Every refused payment imposes a cost that no infrastructure rebuild can recover. This section proposes an engagement model, not just a list of mechanisms.

The Engagement Model

Victim-side pressure does not operate through law enforcement alone. It requires coordinated engagement across five institutional channels, each of which owns a different lever. These channels should be engaged in parallel, not sequentially.

Connection to Supply-Side Operations

Victim-side and supply-side operations should be sequenced to compound each other:

• Takedown operations release decryptors → reduces value of pending ransoms → affiliates receive less from ongoing operations → franchise attractiveness declines
• OFAC designations paired with payment prohibition guidance → victim legal liability for payment → payment refusal rate rises → admin cut volume drops → officer protection payment value drops (Section 9 feedback loop)
• CISA pre-notification programs work best when threat intelligence from monitoring operations is shared in time to enable defensive action, this creates a direct operational link between monitoring decisions (Section 6) and victim-side outcomes

5.7 HUMINT and Cooperator Handling

The playbook references HUMINT as a source across several sections, particularly for protection relationship reconstitution tracking and core team identification. Given that cooperator exposure triggers active counterintelligence responses by Russian agencies, a brief set of handling principles is warranted. These are offered as analytic input; cooperator programs require specific authority and tradecraft that exceeds this document's scope.

Core Handling Principles

• Treat every cooperating actor as a potentially compromised source from day one. Russian agencies conduct counterintelligence against their own criminal assets. Assume FSB awareness of cooperation is a matter of time, not if.
• Limit knowledge of cooperation status to minimum necessary personnel, in both U.S. and host-country institutions. Leaks that burn arrest windows are well-documented; leaks that burn cooperators carry greater human risk.
• Do not take actions against the cooperating actor's associates that would reveal the source or timing of information. Each action should be justifiable from open-source intelligence alone before the cooperator's information is incorporated into operational decisions.
• Suspected cooperators face serious physical risk. The playbook's engagement trigger table (Section 8) identifies cooperator exposure as activating reverse enforcement by Russian agencies. Design debrief programs and subsequent operations with this explicitly in mind.
• Structure debriefs to systematically extract officer contact methods, protection payment documentation, and infrastructure access credentials, the protection layer track depends on this data and it is rarely available through OSINT alone.
• Do not terminate cooperation abruptly. Use decay rather than cutoff to reduce exposure risk, declining contact frequency over time is less detectable than a clean break following an operational action.

Any cooperator program requires dedicated tradecraft expertise and appropriate authority beyond this document’s scope.

SECTION 6 | TAKEDOWN vs. MONITORING: THE CORE OPERATIONAL DECISION

Whether to take down infrastructure or continue monitoring it is one of the most consequential decisions in disruption operations. The central error is treating them as competing options. They are sequential phases of a single operation.

6.1 The Core Tension

Takedown produces immediate disruption and, if infrastructure is seized rather than just shut down, an intelligence windfall, potentially years of logs, user data, transaction records, and admin access patterns. Monitoring produces ongoing intelligence but allows real harm to continue while you watch.

Monitoring advantages: reveals operational intent, planned attacks, internal disputes, and full network structure before disruption. The panic signal after a takedown, who disappears, who migrates, who tries to contact whom, is itself intelligence on network structure. Live channels with operational planning visible generally outweigh the disruption value of shutting them down, unless imminent victim harm is preventable.

Takedown advantages: burn risk, if your access is discovered, you lose the intelligence and actors migrate to a hardened platform. Seized infrastructure often exceeds the value of continued monitoring. The seizure itself is a trust destruction weapon: remaining actors do not know who cooperated or what law enforcement now knows.

6.2 Decision Threshold: When to Move from Monitor to Takedown

SECTION 7 | RUSSIAN AGENCY QUICK REFERENCE

Confidence levels reflect observed enforcement behavior, not legal doctrine. Note: FSB is not treated as a unified actor. Internal factions, competing officer interests, and political dynamics within FSB create divergent enforcement behaviors, the column below reflects FSB's aggregate behavior while Section 9 operationalizes the factional divergences.

SECTION 8 | ENGAGEMENT TRIGGERS TO AVOID

These patterns consistently cause Russian agencies to protect, absorb, or redirect cybercriminals rather than suppress them. They are drawn from historical enforcement outcomes and institutional behavior analysis. Red = high backfire risk (avoid or delay until actor is isolated). Amber = conditional risk (proceed with domestic framing in place).

SECTION 9 | PROTECTION LAYER DISRUPTION: FSB OFFICER LIABILITY TRACK

9.1 Core Concept: Protection as a Load-Bearing Ecosystem Node

FSB officers who provide krysha, recruitment, and protection to cybercriminal actors are not peripheral to the ecosystem, they are load-bearing nodes. Disrupting a criminal actor whose protection relationship remains intact produces reconstitution. Disrupting the protection relationship first, or simultaneously, produces ecosystem degradation.

The mechanism: individual FSB officers maintain protection relationships because they generate personal value, financial, operational, reputational within the service. When a specific protection relationship generates more cost than value, domestic embarrassment, attribution risk to the officer personally, institutional liability to FSB leadership or competing factions, the pressures on that officer change. You are not asking FSB to cooperate as an institution. You are creating conditions where a specific officer's calculus shifts, or where competing FSB factions find it advantageous to act against the liability-generating officer. These are different and more achievable objectives.

This distinction matters operationally. FSB's internal factions do not share interests. An officer in the FSB's economic security directorate and an officer in a cyber unit may be in active competition. Surfacing one officer's criminal financial exposure to competing FSB units, rather than to FSB 'leadership' as an abstraction, is a more precise and realistic targeting objective. Confidence: Medium-High (mechanism is well-supported; execution difficulty is high)

Worked example (Karakurt / Zolotarjovs, May 2026). On 4 May 2026 a US court sentenced Deniss Zolotarjovs to 102 months for his role in Karakurt, a data-extortion group the Department of Justice describes as led by former Conti leadership. DOJ stated the group relied on access to Russian government databases and law-enforcement connections, and paid bribes to secure military draft exemptions and tax avoidance for its members. This is the clearest open-source confirmation to date of the premise in this section: protection is a purchased, load-bearing relationship with named state touchpoints (government databases, draft boards, tax authorities), not a vague tolerance. It also illustrates the officer-liability logic in reverse. The same corruption that shields members is itself documentable financial exposure, exactly the paper trail the financial-exposure methodology below is built to surface. Confidence: Confirmed (DOJ statement and sentencing, 4 May 2026).

9.2 Officer Relationship Types and Leverage

9.3 Financial Exposure Methodology for Officers

FSB officers on government salary who maintain protection relationships with high-volume cybercriminal actors accumulate financial exposure that does not match their declared income. Building this exposure profile requires no HUMINT, it is an open source and financial registry analytic task that extends directly from the criminal-side financial mapping already in this playbook. All deliverables in this section are proposed; none currently exist.

Step 1: Identify Anomalous Outflows from Criminal Actor Finances

This is the keystone analytic task. Detailed methodology in Section 10. For this section: the question to ask of every criminal actor's financial map is what outflows do not fit criminal operational cost profiles.

• Criminal operational costs: hosting, tooling, affiliate payments, mule recruitment, OTC fees, developer salaries, all have identifiable patterns and counterparties
• Protection payments sit outside these patterns: they are recurring, consistent in amount or proportion, do not flow to known criminal operational nodes, and often convert to fiat through channels separate from the main cash-out infrastructure
• Flag these anomalous outflows as protection payment candidates, they are the entry point to the officer financial profile

Step 2: Build the Officer Financial Profile

• Russian property registries: egrn.ru and regional equivalents show real estate holdings in officer and immediate family names
• Corporate registries: egrul.nalog.ru surfaces business ownership, shell companies, consulting firms, and holding structures in spouse or children's names
• European property and corporate registries: country-specific registries (see Annex A) surface Western-held assets; Cyprus, Malta, and pre-2022 EU jurisdictions have historically been favored
• Travel and lifestyle signals: visa application histories, social media, school enrollment records for children, vehicle registrations, build lifestyle inconsistency profile against declared government salary
• Cross-reference: connect anomalous criminal outflows to officer financial profile via timing, amount consistency, and geographic correlation of cash-out endpoints

Step 3: Channel Selection for Exposure

9.4 Manufacturing Internal FSB Contradictions

The goal is not to get FSB to cooperate as an institution, it is to make specific officers liabilities that competing FSB units or FSB leadership's factional interests will act against. This requires surfacing the right information to the right internal FSB audience, which requires knowing which FSB factions are in competition with the officer's unit. Confidence: Medium (mechanism is sound; intelligence requirements are high)

What Makes an Officer a Liability to FSB Leadership or Competing Factions

• Attribution risk: the officer's criminal protection relationship creates a documented link between a specific FSB unit and a ransomware operation that has hit high-profile targets , particularly U.S. critical infrastructure or healthcare, giving competing FSB units leverage against that officer's unit
• Domestic embarrassment: the officer's financial exposure becomes visible in Russian domestic media or through FNS/Rosfinmonitoring processes, creates pressure on leadership to demonstrate institutional integrity
• Operational incompetence signal: the protected actor gets disrupted repeatedly despite protection, makes the officer look ineffective and the protection relationship a waste of institutional resources
• Foreign entanglement risk: evidence that the officer's financial exposure involves Western assets creates counterintelligence concern for FSB leadership, is this officer a recruitment target for foreign intelligence services? This framing activates FSB's counterintelligence units as a potential instrument against the officer

9.5 Portfolio Sequencing for Officer Targets

SECTION 10 | CRYPTO-TO-FIAT METHODOLOGY

10.1 Why This Is the Keystone Analytic Task

Every financial pressure action in this playbook, wallet designations, VASP engagement, correspondent banking exposure, OTC node targeting, protection payment identification, requires knowing where funds become fiat and who touches them. Without a documented cash-out graph, financial pressure actions are targeted at symptoms rather than structural nodes. With it, single actions produce cascading disruptions across multiple actor flows.

The cash-out graph also contains the protection payment data that drives the Section 9 officer liability track. Anomalous outflows, payments that do not fit criminal operational cost profiles, are only identifiable against a complete model of what criminal operational costs look like. Build the model first.

10.2 The Cash-Out Graph: Layer Structure

Worked Examples: Cash-Out Nodes Under Pressure, 2025 to 2026

Garantex was designated in April 2022 and not seized until March 2025, a three-year window of continued high-volume operation under designation. Its successor Grinex was designated in August 2025 and collapsed on or about 16 April 2026 after a drain of roughly $13.7 million. The sequence validates the pre-positioning rule stated in Phase 1: the successor exists before the primary is disrupted, so the attribution and designation pipeline for the most probable successor should be running before the primary node is fully taken. The standing requirement now points at the next successor in the chain. Confirmed on the designation and seizure record. The identity of the next successor is analyst inference.

The AudiA6 action of 10 June 2026 is the clearest recent example of Layers 4 and 5 being taken together. A combined laundering service and over-the-counter layer, integrated with its own forum, was dismantled: roughly EUR 336 million laundered, two administrators arrested, and more than 6,000 verified mule accounts exposed. The mule-account exposure is the part worth studying. A cash-out node that maintains its own inventory of verified accounts turns one takedown into a mule-network dataset, which is precisely the fiat-entry visibility this methodology exists to produce. Confirmed, on the coordinated action by the US Secret Service, IRS Criminal Investigation and European partners.

A third lever has appeared at Layers 2 and 4 that this methodology did not originally account for. Where illicit value moves in stablecoins the issuer can freeze it, and issuer freezes now follow designation within a day rather than over weeks: one July 2026 designation was followed by roughly $131 million frozen at the issuer inside 24 hours. The share of illicit inflows to sanctioned entities that moves through stablecoins is high enough that issuer engagement belongs in the standing financial-pressure repertoire rather than being treated as an occasional windfall. Credible.

10.3 Anomalous Outflow Identification

Once the standard cash-out graph is built, anomalous outflows become visible as flows that do not fit the expected pattern at each layer. These are protection payment candidates.

Criminal Operational Cost Baseline

Establish what normal operational costs look like before flagging anomalies:

• Hosting and infrastructure: BPH provider payments, domain registration, server rental, typically small, recurring, technically-attributable
• Affiliate payments: 70 to 85 percent of ransom value flowing to affiliate wallets, a consistent split ratio identifiable at Layer 3. Advertised splits have risen over time and current franchises market 80 to 85 percent, so the baseline should be checked against the group in question rather than assumed.
• Developer and tooling costs: malware developer payments, crypter services, IAB access purchases, typically one-time or irregular, flow to identifiable underground market nodes
• Mule recruitment and cash-out fees: OTC broker fees (typically 1-5%), mule handler payments, identifiable by counterparty type
• Operational security costs: VPN services, infrastructure rotation, OPSEC tooling, small and recurring

Anomalous Outflow Indicators

• Consistent percentage flows to wallets with no identifiable criminal operational counterparty
• Recurring payments of consistent amounts on regular intervals, salary or retainer patterns not consistent with contractor relationships
• Flows that convert to fiat through separate channels from main cash-out infrastructure, protection payments are often kept operationally separate from the main financial flow
• Payments that predate or follow enforcement non-action on a specific actor, temporal correlation with protection delivery is a strong indicator
• Flows to wallets that connect to Russian domestic banking through politically-exposed-person adjacent accounts

10.4 OTC Broker Network Mapping

OTC brokers are the most critical cash-out bottleneck in the Russian ransomware ecosystem. Unlike exchanges, they are relationship-based, less regulated, and serve as the primary bridge between crypto and Russian domestic fiat for high-volume criminal actors.

OTC Identification Methodology

• Blockchain cluster analysis: OTC brokers accumulate funds from multiple unrelated criminal sources, their wallets show a distinctive pattern of diverse inflows and consistent outflow to banking channels
• Underground forum advertising: major OTC brokers advertise on Exploit, XSS, and Telegram channels, Intel 471 and Flashpoint provide primary visibility
• Exchange KYC linkage: OTC brokers often maintain exchange accounts for liquidity, KYC pressure on exchanges surfaces OTC broker identities
• Rosfinmonitoring cross-reference: high-volume fiat conversion through Russian banking channels without obvious legitimate business origin is flagged by Rosfinmonitoring, cross-reference with blockchain forensics to identify the crypto side of the same broker

OTC Network Graph Components

• Tier 1 brokers: high-volume, serve multiple ransomware groups simultaneously, these are ecosystem-critical nodes whose designation produces cascading effects across multiple actor financial flows
• Tier 2 brokers: group-specific or actor-specific; less systemic impact but more directly traceable to specific actors
• Mule network integration: OTC brokers frequently operate mule recruitment networks as a complementary service, map the connection between OTC operations and mule handler networks
• Geographic concentration: Russian OTC operations tend to concentrate in Moscow, Saint Petersburg, and Yekaterinburg, geographic mapping supports physical surveillance and arrest operations

SECTION 11 | MEASUREMENT FRAMEWORK

Disruption operations without measurement produce narrative, not accountability. This section defines the minimum viable measurement posture for tracking ecosystem health and operational effectiveness. When this playbook was first written, none of it existed. Parts of it now do: a finalised metric framework with defined reading rules, a published series measuring recovery time after each public pressure episode, and a continuously maintained record of enforcement actions and what followed them. Those products are the source of record for measurement, and this section defers to them rather than restating their contents, which is how a static document falls behind a live one. What remains missing is the pressure-effect ledger at 11.4 and the protection-layer indicators at 11.3, neither of which can be built from public data alone.

11.1 Establishing Baselines

KPIs defined without documented baselines cannot be used to attribute change to specific actions versus ecosystem-level trends. Establish baselines before any pressure actions are taken.

• For each KPI: document the 6-month rolling average at the time operations commence, this is your pre-intervention baseline
• Establish a control period of 60-90 days before first pressure action during which KPIs are tracked but no actions taken, this separates pre-existing trend from intervention effect
• Document all significant external events (major law enforcement actions by other agencies, geopolitical developments, cryptocurrency market movements) that could independently affect KPIs, these are confounding variables that must be noted when interpreting results
• For the officer liability track: establish a baseline protection relationship map (Section 9 mapping) before any exposure operations, changes in protection status are only measurable against a documented prior state

11.2 Ecosystem Health KPIs

The metric set itself lives in the measurement framework, not here, and that framework is authoritative on definitions, direction of movement, and the conditions under which a metric should not be trusted. What follows is the map of which product answers which question, so that a reader knows where to go rather than working from a list that ages. Baselines are still required per 11.1 before any of these can attribute change to a specific action.

11.3 Protection Layer Leading Indicators

Reconstitution time is a lagging indicator, it measures outcomes after the fact. The following leading indicators are proposed to track Section 9 progress before protection relationship changes are observable in reconstitution data:

11.4 Pressure-Effect Ledger

Every significant pressure action should be logged in a structured ledger. This enables retrospective analysis of what worked, what failed, and what adaptation patterns emerged.

11.5 Recommended Investment Priorities

These recommendations are offered for consideration by operational and policy stakeholders. Two have moved since the first edition: the measurement layer is now partly built, and the enforcement record is maintained continuously. The remainder are not resourced, and all require appropriate authority and partner coordination before implementation. The order below reflects what is still missing rather than what is merely desirable.

• Intermediary cash-out mapping: converting laundering concepts into repeatable, case-linked cash-out graphs (Section 10). This single investment raises financial plumbing coverage more than any other action. Proposed minimum deliverable: top 20 OTC/broker nodes + mule recruitment patterns + 3-5 end-to-end case exemplars + anomalous outflow registry.
• Protection layer financial exposure capability: applying the Section 10 methodology specifically to identify anomalous outflows as protection payment candidates, then building officer financial profiles using open source registry analysis. Proposed minimum deliverable: anomalous outflow registry for top 20 protected actors + officer financial profiles for identified protection relationships.
• Affiliate mapping and succession pre-positioning: building full affiliate rosters for priority groups with substitutability assessments and pre-positioned pressure on identified successors. Proposed minimum deliverable: affiliate roster + operational signature database + successor map with pre-positioned pressure packages for top 5 groups.
• Underground governance and trust node mapping: identifying escrow operators, forum administrators, and arbitrators, non-technical but ecosystem-critical, low-backfire-risk targets. Proposed minimum deliverable: top 10 trust nodes + dependency analysis + escrow/arbitration record exploitation plan.
• Measurement layer completion: the metric set, the recovery-time series and the enforcement record now exist. What is missing is baseline documentation per 11.1 and the pressure-effect ledger, and without those two, effectiveness claims still rest on narrative. Proposed minimum deliverable: documented pre-intervention baselines for the priority metrics, plus a logging discipline applied to every significant action.
• Identity and continuity package: building cross-platform handle mapping, PGP reuse tracking, panel fingerprints, and brand-asset reuse patterns. Proposed minimum deliverable: cross-platform handle map + PGP reuse database + brand-asset reuse patterns for top 10 groups.

SECTION 12 | TOOL & PARTNER REFERENCE

Vendors provide validation, not conclusions. Outputs should be cross-checked across multiple sources before driving operational decisions.

ANNEX A | EUROPEAN JURISDICTIONAL FRAMEWORK

This annex provides country-by-country assessment of European jurisdictions for third-country arrest viability, legal pre-positioning requirements, and treaty landscape for Russia/CIS-linked cybercriminal actors and FSB officers. Five Eyes jurisdictions (US, UK, Canada, Australia, New Zealand) are treated as assumed known baseline and not covered here.

Assessment criteria for each jurisdiction: extradition treaty status with the U.S.; treaty status with Russia (a bilateral extradition treaty with Russia makes the jurisdiction less viable as Russia can request competing extradition); rule of law and judicial independence; historical cooperation on cybercrime cases; travel pattern intelligence; and practical arrest infrastructure (liaison relationships, legal pre-positioning lead time).

Scope note: this annex assesses arrest viability and legal pre-positioning only. For the broader question of which jurisdictions cooperate, on what, and how reliably, use the separate cooperation assessment rather than stretching the tiers below beyond their purpose. Where the two appear to disagree, the cooperation assessment governs on cooperation and this annex governs on arrest mechanics.

A.1 Tier 1, High Viability (Priority Pre-Positioning)

Germany

Netherlands

Spain

A.2 Tier 2, Conditional Viability (Compressed Assessment)

A.3 Tier 3, Limited Viability

A.4 Avoid, Explicit Entries

A.5 Jurisdictional Quick Reference

A.6 Legal Pre-Positioning Checklist

For each priority jurisdiction where an actor has documented travel patterns, complete the following before any arrest window opens:

• Sealed indictment or arrest warrant filed in U.S. jurisdiction, this is the prerequisite for all pre-positioning
• MLAT request submitted to target jurisdiction, initiate 60-120 days before expected travel window
• Liaison relationship activated: FBI Legal Attaché (Legat) or DEA country office informed and briefed, do not rely on cold MLAT submissions alone
• Provisional arrest framework confirmed with host country judicial authority, know exactly what documentation the host country judge will require
• Travel pattern intelligence current, verify that the subject is still traveling to the target jurisdiction; patterns change
• Competing extradition risk assessed, is Russia likely to file a competing extradition request? If yes, prepare legal response framework in advance
• Operational security: limit knowledge of pre-positioning to minimum necessary personnel in both U.S. and host country, leaks have burned arrest windows in multiple prior cases

DOCUMENT MAINTENANCE

This playbook should be reviewed and updated quarterly. Key triggers for unscheduled updates: major takedown or law enforcement action, significant actor rebrand or ecosystem restructuring, new agency alignment evidence from Russian domestic enforcement, material change in VASP or infrastructure provider compliance posture, new jurisdictional cooperation developments in Annex A jurisdictions, or identification of new FSB officer protection relationships requiring integration into Section 9 targeting.

Changes in this edition. The reconstitution claim is restated as two clocks, node and brand, after the earlier single figure was found to conflate them. The effectiveness evidence is updated to the 2025 payment and 2026 payment-rate picture, including the shift toward fewer and larger suppression payments. Section 10 gains worked cash-out examples from 2025 and 2026 and the stablecoin issuer-freeze lever. Section 11 now defers to the measurement products that exist rather than carrying its own metric list. Annex A is scoped explicitly to arrest mechanics and cross-references the separate cooperation assessment, and the South Caucasus entry is qualified by the June 2024 Yerevan arrest-and-release case. Confidence labelling is applied only to load-bearing claims.

Version tracking is maintained by the document owner and is not reflected in the document text. Recipients should confirm they hold the current version before acting on this analysis.