Playbook Phase A: Nodes 01, 02, 03

Priority Tier: CRITICAL, Build First

Developed by Reno

⚠ Do NOT issue formal extradition requests to Russia. This triggers defensive nationalism and converts broker from criminal liability to protected asset. Pursue third-country arrest opportunities instead.

⚠ Do NOT lead with public attribution before financial actions are in place. Publicity signals to brokers that their records may be compromised, triggering rapid fund movement and account closure.

5. PARTNER LANES

6. RECONSTITUTION MONITORING

Define reconstitution triggers before taking action. The substitutability assessment (pre-action requirement) should predict the likely successor node. Monitor for:

• New wallet clusters receiving funds from known criminal groups, run Chainalysis monitoring alerts on known criminal wallet neighborhoods
• New OTC broker advertisements on underground forums (Garantex-adjacent Telegram channels, forum PM systems), Intel 471 / Flashpoint monitoring
• Correspondent banking route changes: funds appearing through new intermediary accounts in previously unused jurisdictions
• FNS/CBR friction indicators: if domestic pressure is active, monitor for front company restructuring or new entity registrations in actor-linked names

Time-to-reconstitution after designation is a primary KPI. Log baseline from historical designations. A declining trend quarter-over-quarter signals compounding pressure is working.

7. KPIs

8. ENGAGEMENT TRIGGERS TO AVOID

Cross-reference: Main Playbook §8 (full trigger reference).

EDP MODULE 12 SUPPLEMENTAL FINDINGS: OTC BROKERS

• [CREDIBLE] T3 Financial Crime Unit (Tether/TRON/TRM Labs): this unit can blacklist USDT wallet addresses within hours of referral, operating on a faster cycle than OFAC designation. T3 referral is an underused supplement to the standard designation pipeline for USDT-denominated OTC flows and should be run in parallel with, not after, OFAC action.
• [CONFIRMED] Tether USDT blacklisting mechanism: once an address is flagged, it is blocked from transacting on the TRON and Ethereum networks within hours. This is the fastest available financial action against USDT-denominated OTC broker flows and operates independently of any government designation cycle.
• [ANALYST INFERENCE] Khinkali cross-chain routing typology: BTC routed through Avalanche bridge to TRON/USDT before OTC deposit. This routing pattern disrupts standard blockchain clustering. Forensic packages targeting OTC brokers should include Avalanche bridge monitoring as a standard layer, not only BTC and TRON-native tracing.
• [ANALYST INFERENCE] Garantex ruble-liquidity successor as standing intelligence requirement: when a dominant OTC node is designated and seized, a successor emerges within weeks. The forensic and designation pipeline for the most likely successor must be initiated before the primary designation action executes, not after.

NODE 02 | HIGH-RISK / NON-COMPLIANT EXCHANGES

1. ECOSYSTEM ROLE

High-risk exchanges occupy a structurally different position than OTC brokers. Where OTC brokers handle bespoke, relationship-based large transactions, exchanges provide automated, scalable conversion infrastructure, processing both the volume of mid-tier ransomware payments and the layering transactions that precede OTC cash-out for larger ransoms.

Key distinction: exchanges are not just cash-out endpoints. They are also laundering infrastructure. Ransomware actors use non-compliant exchanges as mixing-adjacent layering tools: moving funds through multiple exchange accounts in different names before final cash-out. This makes exchange-level monitoring and KYC pressure a tracing tool as much as a disruption tool.

The Garantex model (designated April 2022, re-designated and seized March 2025) illustrates the pattern: a Russia-based exchange operating with minimal AML controls, knowingly processing criminal proceeds, with blockchain forensics attribution confirming criminal flows constituted a substantial share of volume. Post-designation, criminal actors migrated to successors, but each migration imposed cost and attribution exposure.

2. STRUCTURAL VULNERABILITIES

2.1 KYC/AML Gaps

• Non-compliant exchanges accept funds from sanctioned wallets, mixing services, and known criminal clusters, blockchain forensics can confirm this with high confidence using standard clustering methodology.
• Weak KYC means withdrawal accounts are often pseudonymous or use forged documentation, but exchange records (when seized) provide IP addresses, email accounts, and phone numbers that yield identity leads.
• Exchange operators themselves become high-value targets: they have visibility into transaction records for all criminal customers, not just one group.

2.2 Correspondent and Correspondent-Adjacent Banking

• Even Russia-based exchanges require USD/EUR settlement at some point. USD correspondent banking is US-jurisdiction regardless of originating country, this is the enforcement hook that produced OFAC's Garantex action.
• Payment processors and fiat on/off ramps serving non-compliant exchanges are often registered in third countries, creating additional jurisdiction opportunities.

2.3 Cascading Designation Effect

• Each exchange designation forces criminal actors onto the remaining non-compliant exchange population. This concentrates criminal volume in fewer nodes, which makes those nodes easier to attribute and designate in turn.
• The ecosystem cannot infinitely expand the supply of compliant-appearing, high-volume, abuse-tolerant exchanges. The addressable population is finite and shrinking.

2.4 Supplemental Financial Intelligence (EDP Module 13)

• [CONFIRMED] Garantex 3-year designation-to-seizure gap: Garantex was designated in April 2022 but not physically seized until March 2025, a 3-year window of continued high-volume operation under designation. Enforcement timelines must be institutionalized. Designation without a concurrent physical seizure plan is insufficient for high-volume nodes.
• [ANALYST INFERENCE] Wallet sitting as behavioral deterrence indicator: a measurable dwell time between funds receipt and exchange deposit indicates the actor is monitoring designation status before moving. Rising dwell times across monitored clusters signal that designation pressure is producing deterrence; declining dwell times indicate reduced sensitivity and eroding pressure effect.
• [CREDIBLE] Straw-man account disruption via behavioral biometrics: compliant exchange KYC systems can identify straw-man account structures through behavioral anomalies (device fingerprint inconsistency, login geography mismatch, transaction velocity patterns). VASP engagement packages should include behavioral biometrics referrals as a standard component alongside blockchain forensics.
• [ANALYST INFERENCE] Garantex-tier successor as standing intelligence requirement: the designation and seizure pipeline for the most probable high-volume successor exchange must begin before the primary node is fully disrupted. A 30-day gap is sufficient for criminal volume to reconstitute at an alternative venue. Update July 2026: this played out as predicted. Garantex's successor Grinex was designated in August 2025 and then collapsed on or about 16 April 2026 after an approximately 13.7 million USD drain, which validates the pre-positioning logic; the successor-monitoring requirement now points to the next Grinex successor.

3. PRE-ACTION REQUIREMENTS

Exchange designations require a higher evidentiary standard than wallet designations because they affect all users of the platform, including potentially innocent ones. Ensure blockchain forensics confirm criminal flows as a material share of exchange volume, not just incidental transactions.

• Blockchain forensics: confirm criminal flows (ransomware, darknet markets, sanctions evasion) constitute a material share of exchange volume, Chainalysis / TRM with cross-validation
• Identify exchange's fiat settlement routes: which correspondent banks, payment processors, or banking partners touch the exchange's fiat operations
• Map beneficial ownership: who operates the exchange? Shell company structures, registration jurisdictions, and UBO identification
• Identify top criminal customers by volume: which ransomware groups or OTC brokers are the exchange's largest criminal customers? These become follow-on targets.
• Substitutability: identify which exchanges will absorb migrating criminal volume post-designation; pre-position attribution on those nodes
• Coordinate with FVEY partners: parallel designation maximizes pressure and closes jurisdiction-shopping opportunities

4. ACTION SEQUENCE

Ordered low to high backfire risk.

⚠ Correspondent bank notifications are among the most powerful tools available and carry LOW backfire risk. They are frequently underused. A single notification to a major US correspondent bank processing an exchange's settlements can be more disruptive than a formal designation, with fewer legal and evidentiary requirements.

5. PARTNER LANES

6. RECONSTITUTION MONITORING

• Post-designation: monitor for new exchange services advertising in criminal forums, underground market monitoring (Intel 471 / Flashpoint) within 48 hours of designation announcement
• Blockchain monitoring: identify wallets previously transacting with designated exchange that begin transacting with new services, indicates migration pattern
• Volume shift tracking: Chainalysis ecosystem flow analysis showing where criminal volume migrates post-designation; these new nodes become next targets
• Operator reconstitution: where exchange operator was not arrested, monitor for reappearance under new entity names or jurisdictions, beneficial ownership analysis is prerequisite

Post-Garantex, criminal volume migrated primarily to EXCH, Huione Guarantee, and a set of smaller Russian-linked OTC operations. Pre-positioning attribution on these nodes before the Garantex designation would have closed the migration window. Apply this lesson: always designate with successor nodes pre-identified.

7. KPIs

8. ENGAGEMENT TRIGGERS TO AVOID

Cross-reference: Main Playbook §8.

NODE 03 | BULLETPROOF HOSTING (BPH) PROVIDERS

1. ECOSYSTEM ROLE

BPH is the infrastructure backbone of sustained ransomware operations. Unlike legitimate hosting, BPH providers are operationally complicit: they know the nature of their customers' activities and actively resist external disruption. This complicity means abuse complaints to upstream providers and registrars are ignored at the BPH level, but not necessarily at the BPH provider's own upstream dependencies.

The correct targeting model is not the BPH brand, it is the dependency chain above the BPH brand. Every BPH provider has a registrar, a nameserver provider, an ASN or transit provider, and a payment acceptance method. Each of these upstream dependencies is a leverage point that the BPH provider cannot control and cannot easily replace.

2. STRUCTURAL VULNERABILITIES

2.1 Upstream Dependency Chain

• BPH providers are themselves dependent on legitimate infrastructure: domain registrars, DNS providers, upstream transit providers (Tier-1 and Tier-2 ISPs), and CDN/DDoS protection services.
• These upstream providers are legitimate commercial entities subject to US/EU jurisdiction and abuse notification requirements. They are motivated to terminate relationships when presented with documented evidence of criminal use.
• The BPH provider cannot trivially replace its upstream ASN or transit relationship, these are commercial relationships that take time and verification to establish.

2.2 Infrastructure Fingerprinting

• BPH providers and their criminal customers leave persistent infrastructure fingerprints: ASN patterns, hosting behaviors, panel code signatures, and domain registration styles.
• Even after a takedown, if the same BPH provider reconstitutes under a new brand, the same upstream dependencies often reappear, allowing rapid re-attribution.
• Shadowserver and Censys scan data provide near-real-time visibility into infrastructure reconstitution, new domains and ASNs linked to known criminal fingerprints appear quickly.

2.3 Payment Acceptance Exposure

• BPH providers accept payment from criminal customers. These payment rails, cryptocurrency, payment aggregators, or direct bank transfer, are themselves traceable and potentially sanctionable.
• Designating the payment acceptance mechanism for a BPH provider (cryptocurrency wallets, payment processors) raises the cost for criminal customers to pay for hosting.

2.4 Multi-Tenant Criminal Infrastructure

• Most BPH providers serve multiple criminal customers simultaneously. A single BPH provider takedown disrupts not just one ransomware group but all groups using that provider, the multiplier effect is significant.
• Seized BPH backend data yields a customer list across multiple criminal operations, the intelligence value of a BPH seizure compounds across the ecosystem.

2.5 Proactive Infrastructure Identification (EDP Module 09)

• [CREDIBLE] VM template fingerprint blocking (Sophos): shared VM templates used by major BPH providers create reproducible infrastructure fingerprints. Blocking known fingerprints allows private-sector defenders to proactively deny access to over 7,000 servers without waiting for designation. This is a private-sector action track that runs in parallel with government designation pipelines.
• [CONFIRMED] ASN-level blocking as highest cost-effectiveness action (Intel471): blocking the ASN ranges associated with known BPH providers is the most cost-effective defensive action available in the ransomware supply chain. ISP and upstream transit pressure to revoke ASN allocations should be a primary track, not a supplemental one.
• [CREDIBLE] Full entity-chain designation (IBM X-Force methodology): designating a BPH provider while leaving its upstream transit and ASN relationships intact allows rapid reconstitution under a new brand. Designation packages should cover the provider and all identified upstream dependencies simultaneously or within a 72-hour window.
• [CONFIRMED] BEARHOST and Aeza Group as current named high-priority target conglomerates: both are documented as multi-customer BPH operations with confirmed ransomware group customers. These are standing priority targets and should anchor the BPH designation pipeline. Update July 2026: both the designation model and the criminal-prosecution model are now proven against this node. OFAC designated Aeza Group in July 2025 and jointly designated Media Land with Aeza in November 2025, and on 14 July 2026 DOJ unsealed an indictment of three operators of the Media Land and ML Cloud network (more than 62 million USD in victim losses, a 10 million USD Rewards for Justice offer). This is the template the Node 03 pipeline should follow: designation of the full entity chain, followed by named-operator indictment.
• [CREDIBLE] RIPE/ARIN IP range revocation as third disruption track: alongside designation and upstream ISP pressure, formal complaint to regional internet registries (RIPE NCC, ARIN) can result in IP range revocation, removing infrastructure legitimacy at the registry level and triggering wider ISP-level blocking without requiring government action.

3. PRE-ACTION REQUIREMENTS

The Investment Priority for BPH is upstream infrastructure dependency mapping, move from BPH brand lists to provider-of-provider leverage. Build the dependency chain BEFORE taking action. Without it, takedown produces only a brand disruption; with it, takedown can permanently degrade the provider.

• Per target BPH provider, map: registrar, nameserver provider, ASN/transit provider, CDN/DDoS protection provider, payment acceptance mechanism
• Identify criminal customer list: which ransomware groups, darknet markets, or other criminal actors are hosted on the target BPH?
• Infrastructure fingerprinting: document panel code signatures, ASN patterns, domain registration styles, SSL certificate patterns, enables reconstitution attribution
• Substitutability: which other BPH providers will absorb migrating customers? Pre-position upstream dependency mapping on those providers before acting on the primary target.
• Monitoring trigger definition: define the threshold for transitioning from monitoring to takedown (see Main Playbook §6.5, Decision Threshold)
• Coordinate with Shadowserver and Censys for post-takedown reconstitution monitoring, establish baseline before action so reconstitution is immediately visible

4. ACTION SEQUENCE

Ordered low to high backfire risk. Infrastructure actions carry low individual backfire risk but should be coordinated across vectors for maximum effect.

⚠ Monitor before takedown. The intelligence value of a live BPH backend, criminal customer list, operational planning, active campaign data, generally exceeds the disruption value of an immediate takedown. Define the monitoring-to-takedown trigger before beginning (Main Playbook §6.5). Do not allow monitoring to run indefinitely.

⚠ Document all infrastructure fingerprints BEFORE takedown. If the same BPH reconstitutes post-takedown, immediate attribution closes the reconstitution window. Without pre-positioned fingerprints, you restart attribution from zero.

5. PARTNER LANES

6. RECONSTITUTION MONITORING

• Infrastructure fingerprint monitoring: run daily Censys / Shadowserver queries against known BPH fingerprints (panel code, SSL certs, ASN patterns, domain registration style), new hits indicate reconstitution
• Domain registration monitoring: track new domain registrations matching BPH's historical registration patterns (registrar, privacy service, registration timing)
• Criminal customer migration: monitor underground forums for new hosting provider advertisements or references; Intel 471 / Flashpoint real-time monitoring
• ASN routing monitoring: alert on new BGP announcements from IP ranges previously associated with the BPH provider's ASN neighborhood
• Operator identity continuity: if BPH operator is identified but not arrested, monitor for forum reappearance under new handles, underground forum history analysis

The BreachForums reconstitution cycle (Main Playbook §6.4) applies equally to BPH. Each iteration of takedown-and-reconstitution produces intelligence on who rebuilds, where new infrastructure goes, and who the resilient actors are. Monitor reconstitution as the beginning of the next action cycle, not as a failure of the previous one.

7. KPIs

8. ENGAGEMENT TRIGGERS TO AVOID

Cross-reference: Main Playbook §8.

NODE 16 | EXPLOIT / VULNERABILITY BROKERS

1. ECOSYSTEM ROLE

Exploit and vulnerability brokers occupy the highest per-unit-impact position in the ransomware supply chain. A single 0-day acquisition by a CL0p-model operator produced more victim accesses in days than months of IAB market activity across the entire ecosystem. This node enables complete bypass of Node 04 (IAB Markets) for operators with 0-day capability — the financial value of IAB disruption is partially negated if exploit-capable groups remain unaddressed.

The disruption logic is structurally different from every other Phase A node. The primary lever is policy-track: CISA Known Exploited Vulnerabilities (KEV) enforcement, patch mandate acceleration, and bug bounty economics reform. These actions reduce the exploitable window and close the criminal-versus-legitimate price differential. Law enforcement and financial designation are secondary levers, constrained by state adjacency backfire risk. This sequencing is not optional — it reflects the actual leverage structure of the node.

State adjacency is the defining constraint. FSB/GRU maintain parallel vulnerability research and acquisition operations. Some criminal exploit brokers may simultaneously supply state intelligence operations. Dark Covenant 3.0 screening is mandatory before any designation or attribution action. The MEDIUM backfire risk is the highest of any Phase A node and is driven entirely by state adjacency, not operational concern.

2. STRUCTURAL VULNERABILITIES

2.1 Price Differential (Root Vulnerability)

Criminal market prices exceed vendor bug bounty caps by 10x–100x for critical infrastructure-relevant 0-days. This price differential is the root driver of researcher behavior — not ideology or criminal intent. The supply pipeline exists because the financial incentive exists. No law enforcement action addresses this root cause; only bug bounty economics reform durably closes the gap. Until the differential narrows, disrupting individual brokers shifts researchers to new brokers rather than legitimate programs.

2.2 Forum Matchmaking Dependency

Criminal forums (RAMP, XSS, DarkForums) are the primary broker-to-buyer discovery mechanism. 'Seeking 0-day' threads on these platforms provide the earliest available signal of RaaS group acquisition intent — upstream of any other warning indicator. This is a Node 07 dependency: Underground Forums disruption (Phase B) compounds exploit broker matchmaking friction and provides pre-deployment victim notification opportunities via CISA and sector CERTs.

2.3 Financial Infrastructure Overlap

High-value exploit transactions (six-to-eight figures) require functioning cryptocurrency OTC and exchange infrastructure. Phase A financial pressure (Nodes 01–02) degrades liquidity available for major exploit purchases. Effective Nodes 01–02 disruption simultaneously degrades the financing layer for exploit acquisition. Coordinate timing to compound these effects.

2.4 Patch Window as Counter-Lever

Every exploit has a natural expiration date triggered by vendor patching. CISA KEV enforcement and patch mandate acceleration continuously shrink the exploitation window. Current enterprise patch deployment averages 30–60 days for the software categories most targeted by criminal operators (file transfer tools, VPN appliances, enterprise collaboration). Shortening this window degrades exploit ROI regardless of whether the broker transaction is disrupted. Patch velocity is the only durable counter.

2.5 CL0p Off-Market Model (Structural Exception)

CL0p and analogous operators have developed direct researcher relationships that bypass the criminal broker market entirely. For this actor segment, broker interdiction has no effect — there is no broker to target. Only patch velocity acceleration addresses this capability. This segment must be tracked separately and should not be conflated with broker-dependent actors when assessing action effectiveness. Identifying which RaaS programs maintain off-market 0-day capability is a standing IC collection requirement.

3. PRE-ACTION REQUIREMENTS

Dark Covenant 3.0 screening: mandatory before any designation, attribution, or law enforcement action. Sequence policy-track actions (CISA KEV enforcement, bug bounty economics reform) first — zero state adjacency exposure. Proceed to financial designation and attribution only after confirmed-criminal-only operator screening has been completed. This sequencing requirement is non-negotiable for this node.

Forum monitoring build-out: integrate exploit broker 'seeking' thread surveillance into existing Node 07 (Underground Forums) collection operations before any disruptive action. This provides pre-deployment early warning and establishes the intelligence baseline required to assess broker-to-buyer relationships and identify successor nodes.

Substitute node pre-positioning: identify which brokers will absorb migrating buyers post-designation. Pre-position attribution on successor nodes before acting on primary targets. Historical pattern (Zerodium price cap period, 2019–2023): supply redirects within days to weeks following individual broker disruption.

RaaS group segmentation: identify which RaaS programs maintain 0-day acquisition capability (CL0p model) versus which are exclusively dependent on IAB-sourced credential access. This segmentation determines whether exploit supply disruption or IAB disruption is the effective lever for each target group and prevents misallocation of action resources.

4. ACTION SEQUENCE

Ordered by timeline and backfire risk. Policy-track actions (1–2) carry no state adjacency exposure and should be initiated immediately and maintained continuously. Intelligence and LE actions (3–5) require Dark Covenant 3.0 screening and forum monitoring build-out as prerequisites.

5. PARTNER LANES

6. RECONSTITUTION MONITORING

Forum monitoring continuity: maintain 'seeking 0-day' thread surveillance on RAMP, XSS, and DarkForums as a continuous operation, not an event-based trigger. Broker displacement following disruption shifts demand to new channels within days; monitoring must pre-date any action to establish a baseline and detect migration.

Successor broker identification: track new broker-to-buyer matchmaking signals in encrypted channels and underground forums following any designation action. Supply redirection — not supply elimination — is the primary reconstitution pattern for this node. Pre-positioned attribution on successor nodes is required before acting on primary targets.

Patch velocity baseline maintenance: establish and maintain enterprise patch deployment time baselines for the software categories targeted by CL0p-model operators (file transfer tools, VPN appliances, enterprise collaboration). CISA KEV enforcement effectiveness is measured against this baseline; declining baseline times confirm policy-track actions are working.

RaaS exploit acquisition signal monitoring: alert on evidence of RaaS group 0-day acquisition through SIGINT or HUMINT channels. New mass exploitation campaigns by previously credential-dependent groups signal acquisition of new off-market capability — treat as a new actor assessment, not a continuation of the prior profile. Update RaaS group segmentation (Section 3) accordingly.

7. KPIs

8. ENGAGEMENT TRIGGERS TO AVOID

Cross-reference: Main Playbook §8.

EDP MODULE 06 SUPPLEMENTAL FINDINGS: EXPLOIT / VULNERABILITY BROKERS

• [CONFIRMED] CL0p mass exploitation scale: a single 0-day acquisition produced more victim access than months of IAB market activity across the entire ecosystem. The per-unit impact of exploit acquisition is the highest of any node in the dependency map. Node 04 (IAB Markets) disruption is insufficient for groups with this capability. [Source: CL0p MOVEit and GoAnywhere campaigns, Module 06 Section 2]
• [CONFIRMED] Price differential: criminal market prices exceed vendor bug bounty caps by 10x–100x for critical infrastructure-relevant 0-days. No law enforcement action addresses this root driver. The gap has not narrowed materially despite years of enforcement action against individual brokers. [Source: Zerodium/Crowdfense pricing analysis, Module 06 Section 2]
• [CONFIRMED] 30–60 day average enterprise patch deployment window: this is the primary exploitable gap in the defensive posture. CISA KEV enforcement and federal procurement patch mandates are the only actions that durably close this window. Patch velocity is the single durable counter to 0-day acquisition capability. [Source: CISA KEV data, Module 06 Section 6]
• [ANALYST INFERENCE] FSB/GRU parallel exploit acquisition operations create real state adjacency risk: Dark Covenant 3.0 screening is mandatory before any designation or attribution action at this node. Some criminal broker operators may simultaneously supply state intelligence operations. Backfire risk is MEDIUM — the highest of any Phase A node. [Source: Module 06 Section 2; Dependency Map Node 16]
• [ANALYST INFERENCE] CL0p off-market acquisition model as standing IC collection requirement: when a RaaS group acquires internal or near-exclusive researcher relationships, criminal broker interdiction becomes ineffective for that group. Identifying which RaaS programs have off-market capability should be a standing collection requirement updated quarterly or following any new mass exploitation campaign by a previously credential-dependent actor. [Source: Module 06 Section 8]

NEXT STEPS

Phase A (CRITICAL nodes, including Node 16 Phase A+ prerequisite) is complete. Recommended Phase B sequence:

• Node 04, IAB Markets | Primary: FVEY LE + private sector underground monitoring
• Node 07, Underground Trust Infrastructure | Primary: FVEY LE + Intel 471 / Flashpoint
• Node 08, Mixing / Obfuscation Services | Primary: OFAC + blockchain forensics

Phase B nodes share two characteristics: lower individual backfire risk than CRITICAL nodes, and high ecosystem-level impact when combined with the financial pressure established in Phase A. IAB and trust node disruption attacks the operational engine; mixing disruption attacks the financial obscuration layer. All three compound the pressure imposed by the CRITICAL node actions.

Document maintenance: review and update each node playbook quarterly, or following any major takedown, actor rebrand, significant enforcement action, or material change in VASP / infrastructure provider compliance posture.