Framework Overview and Reader's Guide

Framework Overview and Reader's Guide

Version 0.3 | July 2026 | Working Document

Developed by Reno

SECTION 1 | WHAT THIS FRAMEWORK IS

The Russia-linked ransomware ecosystem does not reconstitute because it is resilient by accident. It reconstitutes because the criminal infrastructure, financial rails, and state protection relationships that sustain it are left intact after episodic disruption operations. Takedowns create friction. They do not create degradation unless the friction compounds over time across multiple layers simultaneously.

This framework is a structured system for producing that compounding effect. It defines the ecosystem, identifies its structural leverage points, assigns operational pressure across interagency lanes, measures the effects of that pressure, and maintains accountability for whether actions are producing the degradation they claim to produce.

1.1 What This Framework Is Not

• A policy document or legal authority. Nothing in this framework constitutes operational authorization.
• A targeting directive. KPI outputs are measurement and accountability tools, not targeting panels.
• A static product. The ecosystem adapts. This framework must evolve with it.
• A leadership optics scorecard. Every metric traces to concrete underlying data. Undocumented operations do not count.
• A global ransomware framework. All documents are scoped to Russia/CIS-linked ransomware and associated enabling infrastructure unless explicitly stated otherwise. Do not apply to global ransomware without revisiting design assumptions.

1.2 The Strategic Logic

The Russia-linked ransomware ecosystem has three structural dependencies that, when pressured simultaneously, produce compounding friction:

Pressure on any single dependency creates friction. Pressure on all three simultaneously creates degradation. The framework is designed to impose all three simultaneously, compounding over time.

SECTION 2 | THE FRAMEWORK SUITE

The framework consists of twelve documents and one Excel workbook. They are grouped into three tiers based on audience and operational sensitivity.

2.1 Foundation Documents (Read in Order)

2.2 Strategic and Institutional Documents

2.3 Node Disruption Playbooks

2.4 Measurement and Tracking Documents

2.5 Reference and Training Documents

SECTION 3 | HOW THE DOCUMENTS CONNECT

The documents are not independent. Each feeds the others. Understanding the connections is required to use the suite effectively.

3.1 The Causal Chain

The framework is built on a single causal chain. Operations at the micro level must feed metrics at the meso level, which must explain movements at the macro level. If any link in the chain is missing, the macro numbers are not defensible.

SECTION 4 | WHERE TO START BY ROLE

Different roles require different entry points. This section gives a direct reading path for each.

Senior Leadership / STRAT Offices

• Read this document (Doc 00) for framework orientation.
• Read the Operator Snapshot section of the Ecosystem Disruption Playbook (Doc 02) for mission and four-phase summary.
• Review the Macro KPI Dashboard tab in the Excel workbook (Doc 09) for current ecosystem status.
• The KPI Framework document (Doc 08) Section 2 covers what each macro metric means and how to interpret it.
• Do not read node playbooks or the protection layer annex at this entry point. Those are Tier 2 operational documents.

Operational Leads (New to Framework)

• Read the Glossary (Doc 01) first. Many terms are framework-specific or used in non-standard ways.
• Read the Ecosystem Disruption Playbook (Doc 02) in full. This is the strategic foundation.
• Read the RU_GOV Protection Framework (Doc 04) for the institutional exploitation layer.
• Read the Dependency Map (Doc 03) for node priority and partner lane assignments.
• Then read the relevant phase playbook for your assigned node lane.
• Read the KPI Framework (Doc 08) to understand measurement obligations before any action.

Analytic Leads (Measurement and Reporting)

• Read the KPI Framework (Doc 08) in full. This is your primary reference document.
• Set up the Excel workbook (Doc 09) for your reporting cycle.
• Read the Historical Case Studies (Doc 12) to calibrate WAIS scoring and understand what framework-scored events look like in practice.
• Maintain the Group Pressure Tracking Template (Doc 11) for each active target group.
• The strife event log (KPI Framework Section 5.2) is your primary IC-value product. Own it.

Interagency Partners (Receiving Suite for First Time)

• Read this document (Doc 00) for full suite orientation.
• Read the Glossary (Doc 01).
• Identify your node lane from the Dependency Map (Doc 03) partner lane matrix.
• Read the relevant phase playbook for your assigned nodes.
• Review the Ownership Map in the KPI Framework (Doc 08, Section 7) to understand what metric population your agency is responsible for.
• Contact the framework coordinator to confirm your agency's ownership assignments and establish reporting cadence.

SECTION 5 | KNOWN GAPS AND SCOPE BOUNDARIES

This section is explicit about what the framework does not yet cover. Gaps are not failures. They are the next coordination agenda.

5.1 Nodes 12-15

The Dependency Map identifies 16 ecosystem nodes; Node 16 (Exploit/Vulnerability Brokers, CRITICAL) was added per the Module 06 assessment and does not yet have a playbook phase or meso-layer tracking. The node playbooks (Phase A/B/C) cover Nodes 01-11. Nodes 12-15 (Gray-Market VPS Networks, Domain/DNS Ecosystems, Data Exfiltration Staging Infrastructure, and Operational Proxy/Anonymization Services) are mapped in the Dependency Map but do not yet have companion playbooks or meso-layer KPI tracking. These nodes are designated MEDIUM priority with lower standalone disruption value. They will be incorporated into meso-layer tracking in a future framework update.

5.2 GRU-Nexus and SVR-Adjacent Actors

Actors with confirmed GRU operational nexus or SVR infrastructure overlap are explicitly outside this framework's scope. The institutional leverage logic (FSB factional exploitation, FNS exposure, MVD referrals) does not apply to state employees conducting military operations. These actors require separate analytic frameworks and different authority structures. If GRU nexus indicators are observed during operations within this framework, flag separately through appropriate channels.

5.3 Non-Russia CIS Actors

Actors operating under Kazakh, Belarusian, or other non-Russian CIS state protection require jurisdiction-specific analysis. This framework's institutional pressure points (FSB, MVD, FNS, CBR) are Russian. Belarus is operationally equivalent to Russia for framework purposes. Kazakhstan has functioned as an actual enforcement partner on specific cases and its dynamics differ meaningfully. Other CIS jurisdictions require case-by-case assessment.

5.4 L2 Ownership Gaps

Several high-value metrics in the KPI framework are designated Level 2 (Requires Buy-In) because they require formal interagency ownership or classified collection feeds that are not yet assigned. The most critical unresolved gap is the micro-layer operation log aggregator: without a designated agency or team responsible for collecting and maintaining per-operation logs across all active operations, the causal chain from micro to macro cannot be maintained. This gap is identified in the KPI Framework ownership map (Doc 08, Section 7) and is the highest-priority interagency coordination item.

5.5 Protection Layer Intelligence Products (Tier 1 Analytic Gap)

The protection layer disruption track (Doc 02, Section 9) is this framework’s primary strategic differentiator from prior disruption approaches. Its core premise is that FSB officer protection relationships are load-bearing ecosystem nodes, and that disrupting the officer’s financial exposure and internal FSB standing produces more durable ecosystem degradation than disrupting the protected criminal actor alone. This premise is analytically sound and well-supported by the institutional dynamics documented in Doc 04.

The intelligence products the track requires do not currently exist. Doc 02, Section 9.3 explicitly notes: “All deliverables in this section are proposed; none currently exist.” The three minimum deliverables required to execute the protection layer track are: (1) an anomalous outflow registry for the top 20 protected actors, identifying protection payment candidates from crypto-to-fiat financial maps; (2) officer financial exposure profiles built from open-source property registries, corporate registries, and lifestyle inconsistency analysis; and (3) a cash-out graph covering the top 20 OTC and broker nodes with end-to-end case exemplars. None of these products are built. Until they are, the protection layer disruption track is a documented methodology without an executable intelligence base.

This is the framework’s highest-priority analytic production gap. The intermediary cash-out mapping program and protection layer financial exposure capability are identified as the top two investment priorities in the Dependency Map (Doc 03, Section 3). Neither requires classified collection. Both are open-source and financial registry analytic tasks executable with existing blockchain forensics tools and OSINT methodology. The gap is one of resource allocation and tasking authority, not methodology.

5.6 Group Tracking vs. Actor Targeting

The Group Pressure Tracking Template (Doc 11) and Group Pressure Tracker tab in the Excel workbook (Doc 09) track group-level pressure effects. They do not constitute targeting directives for individual actors. Individual actor-level data (named operator identities, protection officer relationships, cooperation output from specific debriefs) is maintained in the Tier 3 controlled analytic annex under existing foreign-intelligence minimization rules, not in Tier 2 framework documents.

SECTION 6 | DOCUMENT REGISTRY

Current status of all documents in the framework suite as of July 2026.

SECTION 7 | GOVERNANCE SUMMARY

Full governance detail is in the KPI Framework document (Doc 08, Section 8). This section provides the key rules for all users.

What This Framework Authorizes

• Measurement and accountability for disruption operations.
• Analytic input for operational planning.
• Interagency coordination on metric ownership and reporting.
• Strategic-level reporting to leadership on ecosystem degradation.

What This Framework Does Not Authorize

• Operational authorization for any specific action. Agency-specific authorities and approval processes govern operational decisions.
• Targeting of specific individuals. The framework tracks counts and trendlines of cases and relationship states, not a targeting panel.
• Use of macro KPI movements to justify new operational authorities without corresponding micro and meso evidence. A macro number moving in the right direction is not sufficient basis for expanded authorities. The causal chain must be shown.
• Distribution of Tier 3 controlled annex content (protection relationship inventory with individual officer detail) beyond analytic teams with appropriate authorities.

RANSOMWARE ECOSYSTEM DISRUPTION FRAMEWORK: OVERVIEW v0.3 — July 2026

Working Document — Handle Per Originating Agency Protocols