Framework Case Studies

Historical Case Studies: KPI Framework Applied

Version 1.1 | June 2026 | Working Document | v1.1: WAIS values superseded by Doc 13 back-test; Black Basta outcomes resolved

Developed by Reno

PURPOSE AND HOW TO USE THIS DOCUMENT

This document applies the Ransomware Ecosystem Disruption Measurement Framework retrospectively to five significant real-world operations and events. The purpose is threefold.

• Proof of concept: demonstrate that the KPI framework produces meaningful, defensible assessments when applied to documented events.
• Training: give analysts and operators a concrete reference for how to score events using the Weighted Arrest Impact Score (WAIS), how to read strife indicators, and how to connect node-level pressure to macro ecosystem effects.
• Baseline: establish reference points for what high-impact, moderate-impact, and limited-impact operations look like in practice, so future scoring is calibrated against real examples rather than abstract definitions.

Each case study is structured identically: background, ecosystem role, framework layer analysis (macro/meso/micro), WAIS score where applicable, strife indicators observed, and key lessons for future operations.

Cases are presented in chronological order. The Conti case is the most thoroughly documented and serves as the primary calibration reference for the WAIS scoring system.

CASE STUDY 1 | CONTI COLLAPSE (2022)

Type: Internal Collapse triggered by External Leak | Date: February 2022 (leak) through mid-2022 (dissolution)

Background

Conti was among the most prolific and operationally sophisticated ransomware groups in documented history. Operating as a closed hierarchical RaaS with employed operators rather than independent affiliates, Conti was responsible for hundreds of confirmed attacks including multiple critical infrastructure incidents. At peak operation the group functioned as a structured criminal enterprise with departments, salaries, HR processes, and management hierarchy.

In February 2022, following Conti leadership's public statement of support for Russia's invasion of Ukraine, a disgruntled Ukrainian-affiliated member leaked approximately 60,000 internal chat messages, source code, and operational files. The leak exposed the group's internal structure, financial flows, personnel, infrastructure, and protection relationships in unprecedented detail.

Ecosystem Role at Time of Collapse

Framework Layer Analysis

Macro Layer Effects

• Payment volume: Chainalysis data shows Conti-attributed wallet activity dropped sharply through Q2-Q3 2022 as the brand dissolved. Total ecosystem payment volume did not fall proportionally, indicating rapid migration to successor brands.
• Victim count: leak site posting ceased within weeks of the internal collapse. No successor brand maintained the Conti name at operational scale.
• Domestic enforcement: no Russian domestic enforcement action against identified Conti principals has been publicly confirmed as of the original date of this document. Update July 2026: this remains true inside Russia; the first courtroom outcome in the Conti-descendant line came on 4 May 2026, when Deniss Zolotarjovs of Karakurt (which DOJ ties to former Conti leadership) was sentenced in the US to 102 months, with DOJ stating the group used Russian government database access and paid bribes for draft exemptions and tax avoidance, placing protection-layer corruption on the public record.

Meso Layer Effects

Micro Layer: Strife Event Log Entry

Strife Proxy Metrics Observed

Key Lessons for Framework Application

• The Conti collapse was not caused by Western pressure. It was caused by an internal political miscalculation. The ecosystem effects, however, are identical to what a successful targeted exposure operation would aim to produce. This case calibrates what maximum-effect strife looks like.
• Reconstitution did not fail because the criminal capacity was destroyed. It failed because the trust infrastructure was destroyed. Personnel dispersed into successor brands because no one trusted each other enough to rebuild under the Conti name. Trust infrastructure (Node 07) is the critical variable.
• Successor brand emergence was rapid (under 60 days) but fragmented. Individual successor brands never approached Conti's operational scale. This is the expected pattern after a high-trust-cascade event: ecosystem capacity is preserved but distributed, making it less efficient and more visible.
• The protection relationship status is the unresolved question. The leak exposed FSB contacts but no domestic Russian enforcement followed. This is consistent with the framework's analysis: FSB protection, once activated, is not reversed by embarrassment alone. It requires the krysha relationship to become an institutional liability, not just a visible one.

CASE STUDY 2 | QAKBOT TAKEDOWN: OPERATION DUCK HUNT (August 2023)

Type: Law Enforcement Takedown (Sinkhole and Infrastructure Seizure) | Date: August 2023

Background

QakBot (also known as Qbot and Pinkslipbot) was one of the most widely deployed malware loader ecosystems in operation, with an infection history spanning over 15 years. By 2023 it had become a primary delivery mechanism for ransomware payloads, having delivered Black Basta, Conti successor variants, and multiple other RaaS operations to victim networks at scale.

Operation Duck Hunt, executed by the FBI in coordination with international partners in August 2023, sinkholed QakBot's C2 infrastructure and pushed a removal tool to approximately 700,000 infected hosts. The operation represented the reference model for botnet/loader disruption and is cited explicitly in the framework's Node 05 playbook.

Ecosystem Role at Time of Takedown

Framework Layer Analysis

Macro Layer Effects

• Payment volume: no statistically significant drop in ecosystem-wide ransom payment volume attributable to QakBot disruption in Q3-Q4 2023. Victims affected were remediated before ransomware deployment, preventing payments, but the ecosystem as a whole absorbed the disruption.
• Victim count: affiliated ransomware groups reported temporary slowdowns in victim pipeline. Black Basta activity dropped noticeably in the 30-60 day window post-takedown before recovering.
• This is the expected pattern for a node-level disruption without corresponding financial and meso-layer pressure on the same actor set simultaneously.

Meso Layer Effects

Reconstitution Tracking (Node 05 Reference Model)

Key Lessons for Framework Application

• Operation Duck Hunt is the reference model for Node 05 disruption. The simultaneous sinkhole plus victim notification plus removal tool delivery is the correct operational model. Any botnet/loader disruption that does not include all three components will score lower on Reconstitution Impact.
• The IAB price spike in the 30-60 day window post-takedown is a confirmed leading indicator. When Node 05 is disrupted, watch Node 04 IAB pricing immediately. Price increases confirm that the disruption imposed real access costs on ransomware affiliates.
• Reconstitution speed for this operation was faster than the framework's 90-day high-impact threshold would suggest. This reinforces the need for BPH pressure (Node 03) to be applied simultaneously or in advance. QakBot reconstituted partly because hosting infrastructure was not simultaneously degraded.
• No macro-level payment volume effect was observable. This is consistent with the framework's design: a single node disruption without coordinated pressure across financial and access nodes does not move macro metrics. It is a necessary but not sufficient condition for ecosystem-level degradation.

CASE STUDY 3 | LOCKBIT: OPERATION CRONOS (February 2024)

Type: Coordinated Law Enforcement Takedown with Arrests | Date: February 2024

Background

LockBit was the dominant RaaS franchise in the ecosystem at the time of Operation Cronos, accounting for an estimated 25-30% of all publicly claimed ransomware attacks in 2023 based on leak site data. It operated as a franchise model with a large affiliate roster, aggressive recruitment, and the highest public profile of any active group.

Operation Cronos, coordinated by the NCA with FBI, Europol, and multiple national law enforcement agencies, seized LockBit's infrastructure, took control of its leak site (publishing law enforcement content in place of victim data), arrested two LockBit-affiliated operators, and unsealed indictments against additional members including the identified administrator LockBitSupp.

Ecosystem Role at Time of Takedown

Framework Layer Analysis

Macro Layer Effects

• Leak site post volume: LockBit's leak site went dark at time of seizure. Law enforcement publishing victim decryption keys and criminal infrastructure details on the seized site created significant trust disruption.
• Takedown/Relaunch Cycle: LockBit relaunched a new leak site within approximately 5 days, claiming continued operations. However, post-relaunch victim posting volume was significantly reduced for 60-90 days.
• Market share: competitors including RansomHub and BlackCat/ALPHV successors absorbed displaced LockBit affiliates in the 30-90 day window.

Meso Layer Effects

WAIS Scoring: LockBit Operator Arrests

Two arrests were made in connection with Operation Cronos. These are scored individually.

Arrest 1: LockBit-affiliated operator, third-country arrest

Takedown/Relaunch Cycle Analysis

Key Lessons for Framework Application

• The law enforcement reuse of the seized leak site for operational messaging (publishing affiliate data, decryption keys, and mocking the administrator) was a high-value trust cascade action not captured in standard takedown metrics. Future operations should plan this as a deliberate trust disruption step, not an afterthought.
• Fast relaunch (5 days) reflects the absence of simultaneous financial rail disruption. When OTC brokers and mixing services are not simultaneously pressured, the financial capacity to rebuild infrastructure remains intact. Node 01 and Node 08 pressure must be coordinated with infrastructure takedowns to extend reconstitution time.
• RansomHub's emergence as the primary affiliate absorber was rapid and predictable. The framework's substitutability assessment requirement (identify the likely replacement actor before acting) would have flagged RansomHub as a pre-positioning target. Absent that pre-positioning, the ecosystem lost LockBit's brand but not its operational capacity.

CASE STUDY 4 | BLACKCAT/ALPHV: LAW ENFORCEMENT ACTION AND EXIT SCAM (December 2023, March 2024)

Type: Law Enforcement Disruption followed by Suspected Exit Scam | Dates: December 2023 (DOJ action), March 2024 (exit scam)

Background

BlackCat/ALPHV was a technically sophisticated RaaS group operating since late 2021, known for its Rust-based malware, triple extortion model (encryption, leak, and DDoS), and high-profile attacks including Change Healthcare. The DOJ disrupted BlackCat infrastructure in December 2023, obtaining a decryption key and seizing the leak site.

BlackCat regained control of the leak site briefly before the FBI re-seized it. In March 2024, following the Change Healthcare payment (reported at approximately 22 million USD), BlackCat administrators disappeared with the ransom proceeds in what was widely assessed as an exit scam against their own affiliates, with the likely intent of rebranding.

Why This Case Is Analytically Valuable

Framework Layer Analysis

Event 1: DOJ Infrastructure Disruption (December 2023)

Event 2: Exit Scam (March 2024)

Combined Effect Assessment

The two events together produced a higher ecosystem effect than either would have alone. The law enforcement disruption created instability; the exit scam destroyed the remaining trust. This is the compounding effect the framework is designed to produce through deliberate pressure: each action raises the cost of continued operation and lowers the benefit of loyalty to the brand.

Key Lessons for Framework Application

• Exit scams are predictable under certain conditions: large payment received, law enforcement pressure active, administrators facing personal exposure risk. The framework's exit scam frequency proxy metric should be read in context of simultaneous law enforcement activity against the same actor.
• The 48-72 hour relaunch of the leak site after the initial seizure reflects the importance of simultaneous action against hosting infrastructure (Node 03/06) rather than sequential. When hosting is re-seized quickly, it signals that BPH relationships are intact and the cost of reconstitution is low.
• The Change Healthcare payment illustrates the payment volume vs. victim count divergence metric in reverse: a single extremely large payment can move payment volume metrics significantly without representing ecosystem health. Large outlier payments must be annotated separately in KPI C-1 to avoid misinterpretation.

CASE STUDY 5 | BLACK BASTA LEAKS (February 2025)

Type: Internal Leak (Ongoing Event) | Date: February 2025

Background

Black Basta emerged in April 2022 as one of the most significant post-Conti successor groups, widely assessed to include former Conti operators. It operated as a closed hierarchical group with high operational security and targeted high-value victims. In February 2025, a large volume of internal Black Basta chat logs was leaked publicly, attributed to an internal dispute.

The leak exposed internal communications, operational processes, victim negotiation transcripts, and personnel information. The full downstream effects were still developing at the time this document was prepared.

Framework Layer Analysis

Strife Event Log Entry

Comparison to Conti Leak

Key Lessons for Framework Application

• The Black Basta case demonstrates how the framework handles ongoing events. Not every strife event resolves within 90 days. The Layer 2 event log format is designed to capture the event immediately and track effects over time, with PENDING fields updated as information becomes available.
• The pre-existing financial disputes visible in the leaked content are a confirmation of the recruitment term shifts proxy metric: when internal disputes are about financial splits, the group is under pressure. Monitoring affiliate compensation complaints on underground forums provides early warning before a leak event occurs.
• The Conti comparison is instructive for calibrating expected timelines. If the Black Basta leak produces effects comparable to Conti, 90-day dissolution and rapid successor emergence would be the expected pattern. If the group reconstitutes, it suggests the trust infrastructure was more resilient or the protection layer more intact than the Conti comparison would suggest.

SUMMARY: FRAMEWORK SCORING ACROSS ALL FIVE CASES

RANSOMWARE ECOSYSTEM DISRUPTION FRAMEWORK: HISTORICAL CASE STUDIES v0.1 — March 2026

Working Document — Handle Per Originating Agency Protocols — Open Source Analysis Only