Series Monthly Activity Reports EDP monthly intelligence summaries, newest first
JUL
EDP Monthly · July 2026
July 2026 Activity Summary
Tri-lateral sanctions package, the shift to enabler targeting, issuer-level asset freezing, and payment concentration
HTML
JUN
EDP Monthly · June 2026
June 2026 Activity Summary
Operation Endgame's June phase against the loader and stealer layer, the AudiA6 laundering takedown, and confirmed CIS-exclusion enforcement
HTML
MAY
EDP Monthly · May 2026
May 2026 Activity Summary
The Stark Industries seizure, RAMP passing 120 days dark, and supply-chain compromise entering mainstream intrusion reporting
HTML
APR
EDP Monthly · April 2026
April 2026 Activity Summary
Affiliate-pool expansion at unprecedented scale, the Grinex collapse, and the EU ban on the digital ruble
HTML
MAR
EDP Monthly · March 2026
March 2026 Activity Summary
RAMP and LeakBase seized inside five weeks, removing the forum layer that arbitrated recruitment and credential trading
HTML
Series Framework Documents Core framework, 13 documents
Start here New to the framework? The Reading Order document maps the recommended sequence and dependencies between documents. Reading Order →
00
Framework Overview
Ecosystem structure, analytical approach, and document map
PDF 01
Glossary
Standardized terminology for ecosystem actors, nodes, and pressure levers
PDF 02
Ecosystem Disruption Playbook
Master disruption strategy: leverage points, sequencing, and coordination
PDF 03
Dependency Map (Refined)
Structural dependency relationships across all ecosystem nodes
PDF 04
RU Gov Protection Framework
State tolerance model: political protection mechanisms and jurisdictional leverage
PDF 05
Disruption Playbook: Phase A
Financial backbone and infrastructure: Nodes 01, 02, 03
PDF 06
Disruption Playbook: Phase B
Operational engine and obscuration: Nodes 04, 07, 08
PDF 07
Disruption Playbook: Phase C
Delivery and cash-out: Nodes 05, 06, 09
PDF 08
KPI Framework
Measurable indicators for tracking ecosystem disruption pressure
PDF 10
KPI Sourcing Plan
Data sources and collection methodology for KPI tracking
PDF 11
Group Pressure Tracking Template
Per-group template for monitoring disruption pressure indicators
PDF 12
Case Studies
Conti, QakBot, LockBit, BlackCat/ALPHV, Black Basta
PDF
Series Ecosystem Dependency Playbook Modules 15 node-level modules
M01
Stealers
Information-stealing malware: role, vendors, and disruption vectors
HTML M02
Loaders
Malware delivery infrastructure and key loader operators
HTML M03
Crypters
Obfuscation services enabling AV evasion
HTML M04
Callers
Social engineering and victim contact operations
HTML M05
Initial Access Brokers
Network access marketplace: structure, pricing, and interdiction
HTML M06
Exploit Brokers
Vulnerability and exploit supply chain
HTML M07
Ransomware-as-a-Service
RaaS platform structure, affiliate model, and pressure points
HTML M08
Leak Site Operations
Data extortion infrastructure and takedown leverage
HTML M09
Bulletproof Hosting
Resilient hosting infrastructure enabling persistent operations
HTML M10
Underground Forums
Criminal marketplace infrastructure: key forums and disruption vectors
HTML M11
Crypto Mixers
Cryptocurrency obfuscation services and financial interdiction
HTML M12
OTC Brokers
Over-the-counter crypto cash-out infrastructure
HTML M13
Money Launderers
Professional laundering networks and jurisdictional exposure
HTML M14
Mule Networks
Human cash-out infrastructure: recruitment, structure, and interdiction
HTML M15
Negotiation Services
Ransom negotiation intermediaries: role and leverage implications
HTML
Additional Supporting Materials
📄
Inside the Machine: Russian Cyber
Deep-dive background paper on Russian state-criminal cyber relationships, structural enablement, and the political economy of ransomware tolerance.