Series Monthly Activity Reports EDP monthly intelligence summaries — newest first
JUN
EDP Monthly · June 2026
June 2026 Activity Summary
Ransomware ecosystem activity, dependency pressure indicators, and disruption events
MAY
EDP Monthly — May 2026
May 2026 Activity Summary
Ransomware ecosystem activity, dependency pressure indicators, and disruption events
PDF
APR
EDP Monthly — April 2026
April 2026 Activity Summary
Ransomware ecosystem activity, dependency pressure indicators, and disruption events
PDF
MAR
EDP Monthly — March 2026
March 2026 Activity Summary
Ransomware ecosystem activity, dependency pressure indicators, and disruption events
PDF
Series Framework Documents Core framework — 13 documents
Start here New to the framework? The Reading Order document maps the recommended sequence and dependencies between documents. Reading Order →
00
Framework Overview
Ecosystem structure, analytical approach, and document map
PDF 01
Glossary
Standardized terminology for ecosystem actors, nodes, and pressure levers
PDF 02
Ecosystem Disruption Playbook
Master disruption strategy: leverage points, sequencing, and coordination
PDF 03
Dependency Map (Refined)
Structural dependency relationships across all ecosystem nodes
PDF 04
RU Gov Protection Framework
State tolerance model: political protection mechanisms and jurisdictional leverage
PDF 05
Disruption Playbook: Phase A
Access layer — Nodes 01, 02, 03
PDF 06
Disruption Playbook: Phase B
Execution layer — Nodes 04, 07, 08
PDF 07
Disruption Playbook: Phase C
Delivery layer — Nodes 05, 06, 09
PDF 08
KPI Framework
Measurable indicators for tracking ecosystem disruption pressure
PDF 10
KPI Sourcing Plan
Data sources and collection methodology for KPI tracking
PDF 11
Group Pressure Tracking Template
Per-group template for monitoring disruption pressure indicators
PDF 12
Case Studies
Conti, QakBot, LockBit, BlackCat/ALPHV, Black Basta
PDF
Series Ecosystem Dependency Playbook Modules 15 node-level modules
M01
Stealers
Information-stealing malware: role, vendors, and disruption vectors
PDF M02
Loaders
Malware delivery infrastructure and key loader operators
PDF M03
Crypters
Obfuscation services enabling AV evasion
PDF M04
Callers
Social engineering and victim contact operations
PDF M05
Initial Access Brokers
Network access marketplace: structure, pricing, and interdiction
PDF M06
Exploit Brokers
Vulnerability and exploit supply chain
PDF M07
Ransomware-as-a-Service
RaaS platform structure, affiliate model, and pressure points
PDF M08
Leak Site Operations
Data extortion infrastructure and takedown leverage
PDF M09
Bulletproof Hosting
Resilient hosting infrastructure enabling persistent operations
PDF M10
Underground Forums
Criminal marketplace infrastructure: key forums and disruption vectors
PDF M11
Crypto Mixers
Cryptocurrency obfuscation services and financial interdiction
PDF M12
OTC Brokers
Over-the-counter crypto cash-out infrastructure
PDF M13
Money Launderers
Professional laundering networks and jurisdictional exposure
PDF M14
Mule Networks
Human cash-out infrastructure: recruitment, structure, and interdiction
PDF M15
Negotiation Services
Ransom negotiation intermediaries: role and leverage implications
PDF
Additional Supporting Materials
📄
Inside the Machine: Russian Cyber
Deep-dive background paper on Russian state-criminal cyber relationships, structural enablement, and the political economy of ransomware tolerance.