KPI Framework

KPI Architecture

Version 0.3 | June 2026 | Working Document

Developed by Reno

SECTION 1 | PURPOSE AND DESIGN PRINCIPLES

1.1 What This Document Is

This framework provides a structured, operationally defensible system for measuring the sustained degradation of the Russia/CIS-linked ransomware ecosystem. It is designed for IC/LE interagency use, feeding strategic-level matrix development and operational accountability.

It is not a scorecard for leadership optics. Every metric in this framework traces to concrete underlying data, carries an explicit confidence label, and has a stated limitation. Unless otherwise specified, all KPIs are scoped to Russia/CIS-linked ransomware and associated enabling infrastructure. Do not apply this framework to global ransomware without revisiting the design assumptions.

1.2 Framework Architecture

The framework operates at three levels. They are explicitly linked. Micro feeds meso, meso feeds macro. A change at the macro level must be explainable by movement at the meso and micro levels, or the confidence label on that macro metric drops.

1.3 Confidence Labeling System

Every metric carries one of three confidence labels. Confidence reflects source reliability and measurement precision, not the importance of the indicator.

1.4 Maturity Levels

Metrics are designated at one of two maturity levels. This is an honest assessment, not a limitation to hide.

SECTION 2 | MACRO KPIs - THREE THEMES

The framework is organized under three strategic success themes. These are the outcomes that define ecosystem degradation at the senior-reportable level. Each theme carries 3-4 macro KPIs with explicit formula, data source, confidence label, and known limitation.

KPI A-1 | Russian Domestic Actions Against Ecosystem Actors

Reliability: ● CREDIBLE

Definition: Count of Russian criminal, administrative, or tax enforcement actions against actors previously mapped as protected or linked to ransomware ecosystem operations. Includes tax fraud charges, AML actions, currency violations, and organized crime charges. Cyber-specific charges are not required.

• Formula: Count of actions per quarter, broken out by actor tier (elite, mid-tier, support). Primary analytic focus is on elite and mid-tier actions. Support-tier counts are reported but not emphasized in leadership summaries. A count inflated by low-tier symbolic busts does not represent progress toward this framework's objectives.
• Tier weighting: Each quarter, report the breakdown as elite-tier actions / mid-tier actions / support-tier actions. A ratio shifting toward elite and mid-tier is the signal. Raw count increases driven by support-tier arrests are not.
• Data Sources: Open-source Russian court records, MVD press releases, investigative journalism (iStories, Meduza, OCCRP), FinCEN and Rosfinmonitoring cross-referencing
• Known Limitation: Russian domestic actions are frequently unreported or reported with significant lag. Non-public charges may be invisible. Count is almost certainly an undercount.
• Maturity: LEVEL 1 for open-source visible actions. LEVEL 2 for seeded-referral attribution.

KPI A-2 | Time Lag: Referral to Observable Russian Action

Reliability: ● CREDIBLE

Definition: For operations where a financial exposure or referral package was seeded through domestic Russian channels (FNS, Rosfinmonitoring, CBR), the elapsed time between the seeding action and a visible Russian enforcement response.

• Formula: Days from documented referral or seeding action to confirmed Russian enforcement event, per case
• Data Sources: Internal operation logs (micro layer), open-source Russian enforcement reporting
• Known Limitation: Attribution of Russian action to a specific seeding operation is inferred, not confirmed. Correlation is the operative standard. Causation cannot be proven.
• Maturity: LEVEL 2. Requires internal operation log population by owning teams.

KPI A-3 | Protection Relationship Status Inventory

Reliability: ● ANALYST INFERENCE

Definition: Count and status classification of known or assessed protection relationships between Russian state officers or units and ecosystem actors. Status categories: Active, Strained, Broken, Unknown.

• Formula: Snapshot count per quarter by status category. Track transitions (Active to Strained, Strained to Broken) as a separate trend line.
• Data Sources: Underground forum monitoring, blockchain anomaly detection (sudden wallet behavior changes), IC reporting, investigative journalism outputs
• Known Limitation: Status assessment is analytic inference. A relationship assessed as Broken may be suspended rather than permanently severed. Current confidence is ANALYST INFERENCE: the primary data foundation (underground forum monitoring, blockchain anomaly detection) does not meet the CREDIBLE threshold. The CREDIBLE label applies only after L2 IC reporting feeds are formally assigned and operational. Do not brief protection relationship status counts at leadership level without noting this data limitation explicitly.
• Governance Note: At the leadership level, report counts and status categories only. Individual officer-level data is maintained in a controlled analytic annex, not the leadership dashboard.
• Maturity: LEVEL 2. Requires IC reporting feeds and protected analytic annex structure.

KPI B-1 | Weighted Arrest Impact Score (WAIS)

Reliability: ● CONFIRMED

Definition: A composite score for arrest and prosecution events that captures effect quality, not just occurrence. Raw arrest counts treat a single affiliate arrest and a coordinated RaaS core team takedown as equivalent events. WAIS does not.

Scoring principle: it is better to score coarsely but consistently than perfectly but rarely. Where debrief data is unavailable for the Cooperation Output dimension, mark the field PENDING rather than assigning a default value. A pending field is honest. A defaulted score is not.

• Known Limitation: The CONFIRMED reliability label applies to the underlying source data — arrest events, attribution assessments, prosecution outcomes — not to the scoring model itself. WAIS is an analyst-constructed composite framework. The four-dimension structure and point weighting reflect analytical judgment; they have not been independently validated against historical ecosystem-disruption outcomes. Treat WAIS scores as defensible structured estimates, not empirically calibrated measurements. The framework should be reviewed and recalibrated if a sustained data series (10+ scored events) becomes available.

KPI B-2 | FSB/RIS Internal Strife Indicators: Two-Layer Architecture

Reliability: ● ANALYST INFERENCE

Internal strife cannot be systematically quantified. It can be systematically detected and classified. This KPI uses a two-layer architecture: proxy metrics for STRAT reporting and an event log for IC-level analysis.

Layer 1 Proxy Metrics (Quantitative, Directional)

Layer 2 Strife Event Log (IC-Level Analysis)

Qualitative structured entries. This is the primary IC-value product. The Conti leak is the canonical reference: not a number, but an event whose ecosystem effects were measurable in the aftermath.

KPI C-1 | Ransom Payment Volume vs. Victim Count (Divergence Metric)

Reliability: ● CREDIBLE

Definition: Directional trend of total ransom payments against total victim count. The operationally meaningful signal is divergence. When victim counts hold steady or rise while payment volume falls, the business model is degrading independent of attack frequency. Payment volume alone is insufficient.

• Formula: Quarterly - payment volume trend plotted against victim count trend. Report the divergence ratio, not just one line.
• Crypto price normalization: Payment volume is tracked in USD but interpreted with awareness of major crypto-market movements. Large exogenous price swings are annotated in the pressure-effect ledger and are not attributed as disruption effects. A payment volume drop driven by a Bitcoin price collapse is not a KPI success.
• Data Sources: Chainalysis Crypto Crime Report (annual with mid-year updates), TRM Labs Illicit Crypto Report, leak site victim counts via Ransomlook and Ransomwatch
• Known Limitation: Structural undercounting is real and complicated. Monero payments, unreported incidents, and private negotiations are invisible. This metric is a directional trend only. Do not treat absolute figures as precise. Labeled CREDIBLE, not CONFIRMED.
• Maturity: LEVEL 1. Chainalysis and TRM data available now.

KPI C-2 | Victim Payment Rate by Sector

Reliability: ● CREDIBLE

Definition: Percentage of confirmed victims who paid ransom, tracked by sector (critical infrastructure, healthcare, financial services, general commercial). Declining payment rates indicate improved resilience or increased payment-discouragement policy effectiveness.

• Formula: Confirmed payments divided by confirmed victim incidents per sector, per quarter. Trend over rolling 4-quarter window.
• Data Sources: Coveware Ransomware Marketplace Report (quarterly), IR firm case data from Mandiant and CrowdStrike, sector Information Sharing and Analysis Center (ISAC) reporting
• Known Limitation: Denominator (total victim incidents) is significantly undercounted due to non-reporting. Sector breakdowns are approximate. Treat as directional.
• Maturity: LEVEL 1. Coveware quarterly data available.

KPI C-3 | Leak Site Three-Signal Composite

Reliability: ● CONFIRMED

Leak sites are the highest-quality real-time signal in the open-source environment. Three distinct signals are tracked independently. They measure different things and should not be collapsed into a single number.

• Data Sources: Ransomlook, Ransomware.live, Ransomwatch, DarkFeed, cross-validated for accuracy
• Known Limitation: Measures published victims only. Groups collecting ransom without publishing are invisible here. Post volume is a floor, not a ceiling.
• Maturity: LEVEL 1. Open source, available now.

SECTION 3 | MESO LAYER: NODE CLUSTER METRICS

Meso-layer metrics are the causal attribution layer. When a macro metric moves, the meso layer explains why. Without it, macro numbers are undefendable in a STRAT briefing or oversight context. Node IDs map directly to the companion disruption playbooks (Phase A Nodes 01-03, Phase B Nodes 04/07/08, Phase C Nodes 05/06/09). Three clarifications. First, the marketplace-health cluster below is tracked as a supplement to Node 07; Dependency Map Node 11 (Crypter/Packer Services) carries no meso metric and is addressed through private-sector detection levers. Second, there is no M-06 metric ID: leak-site measurement is consolidated under KPI C-3 and rolled up in the Node 06 row. Third, Node 16 (Exploit/Vulnerability Brokers), added to the Dependency Map per Module 06, is not yet tracked at the meso layer and requires a policy-track metric set at the next framework revision.

SECTION 4 | MICRO LAYER: PER-OPERATION LOG TEMPLATE

Every disruption action generates a micro-layer log entry. This is the foundational data that makes meso and macro metrics defensible. If this layer is not populated, the framework loses its causal chain.

The owning team or agency populates this log at three points: pre-action (expected effects), immediately post-action (observed immediate effects), and at 30, 90, and 180-day follow-up for reconstitution tracking.

SECTION 5 | INTERNAL STRIFE ARCHITECTURE

The STRAT-reportable output is not 'internal strife: high.' It follows a specific action, affiliate defection rate increased, two new splinter brands emerged within 60 days, and forum dispute volume against the targeted group spiked. Assessment: pressure-induced trust breakdown. Confidence: CREDIBLE.

5.1 Layer 1: Proxy Metrics (STRAT Reporting Layer)

Quantitative but directional. These do not measure strife directly. They measure conditions that strife produces or precedes. All carry ANALYST INFERENCE to CREDIBLE confidence. Do not interpret any single proxy metric as a standalone signal.

5.2 Layer 2: Strife Event Log (IC-Level Analysis)

Qualitative structured entries. This is the primary IC-value product. Events are episodic and source dependent. The event log is the analytic anchor. Proxy metrics summarize its contents for STRAT audiences.

SECTION 6 | WEIGHTED ARREST IMPACT SCORE, SCORING GUIDE

The WAIS translates arrest and prosecution events into ecosystem-effect assessments. A single affiliate arrest and a coordinated RaaS core team takedown are not the same event. WAIS makes that distinction explicit and defensible.

SECTION 7 | OWNERSHIP MAP

Ownership defines accountability. Every metric requires an agency or team responsible for population, maintenance, and quality control. Where ownership is currently unassigned, this document identifies the gap explicitly. Gaps are not deficiencies. They are the interagency coordination agenda.

SECTION 8 | GOVERNANCE

8.1 Distribution Tiers

8.2 Protection-Layer Panel: Governance Note

• At the Tier 1 leadership level: report counts and status categories only, for example '4 protection relationships assessed as strained this quarter.' No individual names.
• Individual officer-level data is maintained in the Tier 3 controlled analytic annex under existing foreign-intelligence minimization rules.
• Officer-level metrics are counts and trendlines of cases and relationship states, not a targeting panel.
• Sanctions packages are built from underlying case files with appropriate legal authority. The KPI summarizes the status of those packages. It does not drive them.
• If protection-layer analysis surfaces data on domestic persons of any nationality, apply standard minimization procedures immediately.

8.3 Analytic vs. Operational Distinction

This framework is analytic input for operational planning. It does not supersede agency-specific legal authorities or protocols. The KPI outputs are measurement and accountability tools.

• This framework does not constitute intelligence products for targeting.
• It does not replace agency-specific operational authorization requirements.
• It does not override classification and handling requirements for any underlying source material.
• Red flag: using macro KPI movements as justification for specific new operational authorities without showing corresponding micro and meso-level evidence. A macro number moving in the right direction is not sufficient basis for expanded authorities. The causal chain must be shown.

8.4 Framework Maintenance

• Review cadence: quarterly metric review, annual framework structure review
• Version control: maintained by framework coordinator. Changes require interagency working group concurrence.
• Metric retirement: any metric that cannot be populated with reliable data for three consecutive quarters is flagged for review and potential retirement or downgrade to ANALYST INFERENCE.
• Ownership gap resolution: unassigned Level 2 metrics are reviewed at each quarterly meeting for ownership assignment progress. Gaps are reported to senior leadership as interagency coordination requirements, not silently carried forward.

ANNEX A | QUICK REFERENCE: ALL KPIs

All KPIs are scoped to Russia/CIS-linked ransomware and associated enabling infrastructure unless otherwise specified.

RANSOMWARE ECOSYSTEM DISRUPTION MEASUREMENT FRAMEWORK v0.3 June 2026