Playbook Phase C: Nodes 05, 06, 09

WARNING: Do not take down C2 infrastructure before sinkhole is ready. A premature C2 takedown without sinkholing simply orphans the bots, they eventually check in to new C2 after a timeout, and the victim inventory is never captured. Sinkhole and takedown must be simultaneous.

5. PARTNER LANES

6. RECONSTITUTION MONITORING

• Malware sample monitoring: apply developer artifact signatures to new samples daily, Mandiant, CrowdStrike, ESET, VirusTotal feeds; flag any sample matching disrupted loader fingerprints
• C2 infrastructure reconstitution: run daily Censys/Shadowserver queries against known C2 fingerprints (panel signatures, SSL cert patterns, port/protocol behavior); new hits indicate reconstitution
• Spam campaign reappearance: monitor email threat intelligence feeds for distribution campaigns matching prior loader's lure themes, attachment types, and infrastructure
• Underground forum advertising: monitor for new loader services advertised on Exploit/XSS or in private Telegram channels, Intel 471 / Flashpoint
• Victim re-infection telemetry: ISACs and CERTs track re-infection rates for previously notified organizations, rising re-infection signals reconstituted distribution campaign

QakBot reconstitution after Duck Hunt took over a year to reach comparable scale. The Developer artifact database built before Duck Hunt enabled immediate attribution when QakBot reappeared in late 2024 samples. Pre-positioned artifacts are what close the attribution gap, not post-hoc malware analysis.

7. KPIs

8. ENGAGEMENT TRIGGERS TO AVOID

Cross-reference: Main Playbook §8.

EDP MODULE 02 SUPPLEMENTAL FINDINGS: BOTNET / LOADER ECOSYSTEMS (NODE 05)

• [CONFIRMED] Endgame campaign model validated (2024 + 2025 phases): multi-family coordinated operations against loader C2 infrastructure are operationally sustainable and empirically effective. Key gap: distribution infrastructure (Gootloader SEO delivery network, Raspberry Robin NAS/IoT C2) is underutilized as a target. Every Endgame-type operation should include distribution infrastructure takedown co-equal with C2 seizure — C2-only operations leave the infection funnel intact. [Source: Endgame operation reporting, Module 02 Section 2]
• [CONFIRMED] Replace difficulty calibration: HIGH applies to distribution infrastructure (SEO networks, NAS/IoT botnets). Code and brand replace difficulty is LOW. Operations targeting only C2 domains achieve LOW-replace-difficulty disruption — the developer group reconstitutes under a new brand. The IcedID-to-Latrodectus transition demonstrates this rotation. Target the distribution network and developer attribution package, not just the C2 domain set. [Source: Latrodectus/IcedID lineage analysis, Module 02 Section 5]
• [ANALYST INFERENCE] Latrodectus as highest-priority attribution objective: IcedID-to-Latrodectus transition confirms the same developer group cycling through loader brands. Developing full attribution — wallet clustering, C2 infrastructure patterns, underground forum recruitment identifiers — closes the reconstitution window before the next brand rotation. Without this attribution package, each operation resets to zero. [Source: Module 02 Section 8]
• [CONFIRMED] Sequencing: Node 05 loader disruption should coincide with Node 04 IAB market pressure (Phase B), not precede it. Loader disruption alone reduces ransomware delivery capacity temporarily; combined with IAB disruption, it compresses the entire access supply pipeline. Coordinate Phase B Node 04 and Phase C Node 05 operations within the same 30-60 day window for maximum compounding effect. [Source: Module 02 Section 8]
• [CONFIRMED] OFAC designation gap at Node 05: loader developers have not been designated despite documented ransomware enablement evidence from Endgame operations. Extending the designation pipeline to loader developers is an available escalation not yet applied. Dark Covenant 3.0 screening required for Russia-based developers before any public attribution or designation action. [Source: Module 02 Section 8]

NODE 06 | LEAK-SITE HOSTING STACK

PRIORITY TIER: HIGH | PHASE C NODE

1. ECOSYSTEM ROLE

The double-extortion model, encrypt AND threaten to publish stolen data, dramatically increased ransom payment rates when it emerged circa 2019. Before double extortion, victims with good backups could recover without paying. Leak sites changed the calculus: even victims with intact backups now face reputational, regulatory, and legal consequences from data publication.

The leak site is therefore not just a technical node, it is the psychological infrastructure of the ransomware business model. Disrupting it attacks victim payment incentives at the source. Every takedown reduces victim payment probability during active negotiations, even for groups whose sites were not directly targeted: the precedent itself creates doubt.

KEY INSIGHT: Operation Cronos (LockBit, February 2024) used the seized leak site itself as a trust destruction weapon: the NCA/FBI replaced LockBit's content with law enforcement messaging, posted apparent evidence of compromise, and published decryption keys, all from the criminal's own domain. This is the model: seize, exploit the trust destruction, release decryptors, post from the criminal's own infrastructure. Replicate this approach for every major leak site takedown.

2. STRUCTURAL VULNERABILITIES

2.1 Hosting Infrastructure Fingerprints

• Leak sites, even Tor-hosted onion sites, have detectable infrastructure patterns: hosting provider relationships (often BPH, Node 03), server fingerprints, SSL certificate patterns, and panel code signatures.
• BPH pressure (Phase A Node 03) directly degrades the hosting layer for leak sites. Actors forced off quality BPH onto gray-market VPS face higher takedown risk for their leak sites.
• Many leak sites share backend infrastructure with affiliate panels and negotiation portals, a single seizure can simultaneously disrupt the publication mechanism, the affiliate management interface, and the victim negotiation channel.

2.2 Decryptor Release as Force Multiplier

• Every publicly released decryptor reduces the victim's incentive to pay, even for future victims of the same group who have not yet been hit. The threat of decryptor release depresses payment rates across the ecosystem, not just for the specific operation targeted.
• During Operation Cronos, 7,000+ LockBit decryption keys were released publicly. Victims in active negotiations had their incentive to pay removed at the moment of highest leverage. This is the highest-value secondary action from a leak site seizure.
• Even a credible public statement that decryptors exist and will be released, without releasing them yet, reduces payment probability during active negotiations.

2.3 Trust Destruction Value of Seized Infrastructure

• Posting from the criminal's own leak site domain, as Cronos did, signals to every affiliate and potential victim that the platform is compromised. Affiliates do not know what data law enforcement now has. This uncertainty is more operationally damaging than the takedown itself.
• Publishing apparent affiliate identities or operational details from the seized site, even selectively or partially, maximizes the uncertainty effect and triggers affiliate migration.

2.4 Affiliate Confidence Dependency

• RaaS leak sites exist to serve affiliates as much as to threaten victims. Affiliates need confidence that their exfiltrated data will actually be published if victims don't pay. A group whose leak site has been seized loses affiliate confidence immediately, even after reconstitution.
• Post-Cronos, LockBit affiliate roster shrank materially despite rapid technical reconstitution. The platform's track record of being seized is a permanent reputational liability that competing RaaS groups exploit in affiliate recruitment.

2.5 Multi-Tenancy, Torrent Distribution, and VM Template Fingerprints (EDP Module 08)

• [CREDIBLE] Modern DLS infrastructure is multi-tenant: a single hosting stack frequently serves multiple ransomware groups simultaneously. Takedown of one group's DLS does not automatically disrupt co-tenants operating on the same underlying infrastructure. Seizure planning must account for this: pre-action infrastructure mapping should identify all co-tenants before action is taken.
• [CREDIBLE] Torrent-based data distribution (documented in ALPHV/BlackCat and other groups per EDP Module 08) creates a resilience layer that survives DLS takedown. Exfiltrated data distributed via torrent networks persists independently of the hosting stack. Victims remain exposed even after a successful seizure of the primary leak site; victim notification must account for this residual exposure.
• [ANALYST INFERENCE] VM template fingerprints are a viable attribution and collection indicator: groups reusing infrastructure templates leave detectable signatures across DLS rebuilds. Template fingerprint detection enables immediate attribution of reconstituted sites before the group reestablishes affiliate confidence. This is a collection opportunity that should be built into post-takedown reconstitution monitoring protocols, not treated as an operational nuisance.

3. PRE-ACTION REQUIREMENTS

Monitoring a live leak site provides active victim intelligence, which organizations are currently being extorted, at what ransom demand, and at what stage of negotiation. This intelligence has direct harm-prevention value. Define the monitoring-to-takedown trigger before beginning, and include active victim count as a trigger criterion.

• Infrastructure mapping: hosting provider, ASN, panel code signature, backend architecture, enables targeted simultaneous seizure of all related infrastructure
• Active victim inventory: which organizations currently have data staged on the site? This is the harm-prevention victim notification list.
• Decryptor acquisition: coordinate with malware analysis teams (Europol, FBI, private sector) to develop decryptors from seized key material before public release
• Affiliate panel access: if backend access includes affiliate panel, extract full affiliate roster, active campaign list, and negotiation logs before takedown
• Trust destruction content preparation: prepare seized-site messaging, decryptor release announcement, and any appropriate disclosure of operator/affiliate details, ready to publish immediately upon seizure
• Reconstitution fingerprinting: document all infrastructure signatures before takedown so reconstituted site is immediately attributable
• Victim notification coordination: ISAC and sector partner notification pipeline ready before takedown; active victims should be notified within hours of seizure

4. ACTION SEQUENCE

The Cronos model is the reference sequence: monitor → seize at maximum yield → post from criminal's own infrastructure → release decryptors → notify victims → pursue affiliates from seized data.

WARNING: Do not seize the leak site before backend data is fully extracted. Operator may have remote wipe capability. Extraction must complete before or simultaneously with the public takedown announcement.

WARNING: Active victim notification must happen within hours of seizure, not days. Organizations in active negotiations need to know immediately that their negotiating counterpart has been compromised and that decryptors may be available.

5. PARTNER LANES

6. RECONSTITUTION MONITORING

• Domain reconstitution: run daily Censys/Shadowserver queries against known panel code signatures, SSL patterns, and backend fingerprints, new sites matching prior infrastructure fingerprints indicate reconstitution
• Media and forum monitoring: ransomware groups announce reconstitution via press releases on new Tor sites and underground forum posts, Intel 471 / Flashpoint and direct Tor monitoring
• Affiliate recruitment monitoring: post-takedown, groups must re-recruit affiliates; monitor underground forums for new affiliate program announcements tied to the disrupted brand or its successors
• Victim listing resumption: Ransomware.live and RansomLook track new victim postings, monitoring for resumption of victim listing by a disrupted group is the primary operational tempo indicator
• Brand continuity: did the group rebrand? Apply infrastructure fingerprints and malware artifacts to new brand immediately, same developer, same infrastructure, immediate attribution resets the new brand's equity

LockBit reconstituted under the same name within weeks of Cronos, but never recovered affiliate confidence or operational tempo. The seizure is not a failure when reconstitution occurs: the sustained reduction in affiliate confidence and operational scale is the measure of success, not whether the site reappears.

7. KPIs

8. ENGAGEMENT TRIGGERS TO AVOID

Cross-reference: Main Playbook §8.

EDP MODULE 15 SUPPLEMENTAL FINDINGS: NEGOTIATION SERVICES AND PAYMENT BEHAVIOR

• [CONFIRMED] Leak site takedown as principal criminal negotiation lever: every credible Node 06 action directly degrades attacker negotiation leverage by reducing the credibility of data publication threats. Victim willingness to refuse payment increases when the publication threat is less credible. Leak site disruption is the most direct Phase C action on criminal negotiation capability — the two are structurally linked. [Source: Module 15 Section 4]
• [CONFIRMED] Coveware >70% non-payment rate for professional negotiation clients: victims supported by professional ransomware negotiators achieve non-payment outcomes in over 70% of engagements. Scaled access to professional negotiation services is a validated, low-backfire disruption mechanism with direct impact on criminal revenue. Priority sectors for scaled access: healthcare, local government, and education — highest ransomware vulnerability combined with lowest IR retainer penetration. [Source: Coveware quarterly reports, Module 15 Section 4]
• [CONFIRMED] 35% ransomware payment decline in 2024 (Chainalysis) reflects compound disruption: Phase A financial actions (OTC/exchange enforcement), Phase B/C enforcement, and increased victim resistance through professional negotiation support all contributed. The negotiation-side contribution is not separable in the aggregate data but is structurally supported by Coveware outcomes data. The full disruption picture requires both supply-side (EDP Phases A–C) and demand-side (scaled negotiation access) actions. [Source: Chainalysis 2025, Module 15 Section 8]
• [CREDIBLE] Rogue recovery company enforcement gap (RecoveryCo archetype): commercial ransomware recovery firms with undisclosed financial relationships with threat actors represent a documented criminal facilitation of ransomware monetization operating without any regulatory framework. No confirmed prosecutions as of April 2026. Standalone enforcement action required: FTC and DOJ attention; mandatory disclosure and registration framework for commercial ransomware negotiation and recovery services. This does not map to any existing EDP node — it is an independent enforcement gap. [Source: ProPublica RecoveryCo reporting, Module 15 Section 2]
• [ANALYST INFERENCE] LLM-assisted criminal negotiation as pre-positioning threat: AI platform capabilities could be adopted by criminal negotiators to improve throughput, response quality, and multilingual operations before victim-side professionals can adapt. Pre-positioning window is currently open. Engaging AI platform providers on ransomware-specific LLM use monitoring is lower cost now than reactive development after operational adoption. Assign pre-positioning tasking to IC and private sector partners; establish baseline for measuring adoption. [Source: ReliaQuest threat forecast, Module 15 Section 4]

Framing note: Legitimate negotiation services are a demand-side countermeasure, not a criminal supply chain node. No dedicated EDP node for negotiation services — Module 15 Analyst Assessment explicitly recommends against adding one. The correct policy posture is to fund, scale, and regulate legitimate services; criminal-side negotiation is internal to RaaS operations and disrupted indirectly via this node.

NODE 09 | MULE / MONEY LAUNDERING NETWORKS

DUAL-TRACK NODE, Two operationally distinct disruption tracks

TRACK A, RUSSIA-DOMESTIC LAYER

TRACK A.1, ECOSYSTEM ROLE

The Russia-domestic laundering layer handles the integration phase: converting already-cashed-out funds into usable Russian-economy assets. This includes real estate purchases, luxury goods, business investment through front companies, and domestic bank transfers through mule account chains. It operates inside Russian financial infrastructure and requires domestic Russian institutional action to disrupt effectively.

Key actors in this layer: front company directors, domestic mule account holders, shadow banking intermediaries, and the accountants and lawyers who structure the vehicles. These actors have Russian tax, banking, and corporate law exposure that is exploitable without cyber-specific charges.

KEY INSIGHT: Track A disruption is the primary application of the domestic framing principle from Main Playbook §3.1. These actors are not hackers, they are financial criminals committing tax fraud, currency violations, and money laundering under Russian law. FNS and Rosfinmonitoring are more actionable against this layer than any direct LE approach.

STRUCTURAL CONSTRAINT: ROSFINMONITORING CHANNEL LIMITATIONS [CREDIBLE] Rosfinmonitoring should be treated as a routing node and formal channel to maintain, not a reliable primary disruption mechanism for ransomware-connected flows. Structural constraint confirmed per EDP Module 14: Rosfinmonitoring's willingness to action referrals on ransomware proceeds is incentive-dependent rather than institutionally reliable. Its effectiveness tracks with domestic political incentives that are not consistently aligned with FVEY disruption objectives. It remains the most viable formal channel for framing Track A referrals under domestic-law framing; expectations for outcome reliability should be calibrated accordingly. Cross-reference: EDP Doc 04 (RU GOV Protection Framework).

TRACK A.2, STRUCTURAL VULNERABILITIES

Lifestyle and Income Inconsistencies

• Mule network operators and front company directors in Russia frequently display lifestyle assets (real estate, vehicles, travel, business interests) dramatically inconsistent with declared income. This is the FNS exposure surface.
• Russian citizens must declare foreign assets and accounts. Cross-border funds flowing through mule networks often involve undeclared foreign accounts, a direct CBR 115-FZ and currency law violation.

Front Company Structures

• Ransomware laundering fronts are registered as legitimate businesses, construction, IT services, import/export. Their financial flows (large cash deposits, foreign transfers, minimal declared business activity) are anomalous relative to their stated sector.
• Rosfinmonitoring's mapping capability can identify these anomalies through suspicious transaction reporting, particularly where flows touch the Russian banking system.
• Front companies with foreign beneficial ownership or foreign bank relationships create Egmont Group exposure, suspicious transaction reports flow through the financial intelligence network even without Russian political will.

Krysha Dependency

• High-value mule network operators in Russia often have krysha (protection) relationships with regional or local officials. These relationships create exposure for the patron: financial irregularities surfaced through FNS can embarrass the patron and weaken the protection relationship.
• FNS exposure of the patron is a prerequisite for weakening krysha, the protection relationship is maintained only while it is costless for the patron.

TRACK A.3, PRE-ACTION REQUIREMENTS

Track A actions must be framed entirely in domestic Russian law terms. Tax fraud, undeclared income, currency violations, and organized crime, not hacking or cyber charges. Any framing that signals foreign LE direction of domestic referrals burns the referral channel. See Main Playbook §3.1 and §8.

• Lifestyle inconsistency package: identified real estate, vehicles, travel, and business interests vs. declared income, built from OSINT and financial intelligence before any referral
• Front company financial anomaly documentation: Russian company registration data, banking relationships, sector-inconsistent transaction patterns, Rosfinmonitoring referral-ready format
• Foreign asset and account exposure: undeclared foreign assets or accounts attributable to target actors, CBR 115-FZ and currency law violation basis
• Krysha mapping: which officials or political patrons are associated with the target network? FNS patron exposure strategy requires knowing who to embarrass.
• Domestic charge equivalents: for every foreign LE charge, identify the Russian law equivalent, Article 210 (criminal organization), Article 174 (money laundering), tax code violations, so that referrals frame in domestic law terms

TRACK A.4, ACTION SEQUENCE

All Track A actions must be routed through domestic Russian institutional channels. Direct foreign LE action against Russia-domestic actors triggers backfire. The sequencing principle: surface domestic exposure first, let Russian institutions act on their own institutional incentives.

WARNING: Do not frame Track A actions as foreign LE-directed. If Rosfinmonitoring or FNS are seen as acting under foreign direction, all Russian agencies resist and the referral channel is burned. Route through institutional incentives, FNS has modernization objectives; CBR has 115-FZ compliance obligations, not through political requests.

WARNING: Do not pursue direct extradition requests for Russia-domestic mule network operators. This triggers the full backfire sequence. Pursue third-country arrest opportunities for operators who travel internationally.

TRACK A.5, PARTNER LANES

TRACK A.6, KPIs

TRACK A.7, ENGAGEMENT TRIGGERS TO AVOID

Cross-reference: Main Playbook §8.

TRACK B, THIRD-COUNTRY MULE RECRUITMENT LAYER

TRACK B.1, ECOSYSTEM ROLE

The third-country mule recruitment layer operates entirely outside Russia, in Western Europe, Asia, North America, and emerging market jurisdictions. Recruited mules, often unwitting or semi-witting, receive funds into personal or business accounts and transfer them onward, providing the layering and integration steps that distance the original ransomware proceeds from their source.

Recruitment patterns: romance scams, fake job advertisements (money transfer agent, financial compliance roles), cryptocurrency investment schemes, and compromised legitimate businesses used as unwitting conduits. Mule recruiter networks are organized crime operations in their own right, frequently overlapping with West African fraud networks, Eastern European OC groups, and Southeast Asian scam compound operations.

KEY INSIGHT: Track B disruption is LE-primary and does not involve Russian institutional engagement at all. This is entirely a FVEY LE and financial sector problem, operating under Western legal authorities, with no backfire risk from Russian state protection dynamics. The partner constellation is completely different from Track A.

TRACK B.2, STRUCTURAL VULNERABILITIES

Mule Recruitment Infrastructure Visibility

• Mule recruitment advertisements, fake job postings, social media solicitations, romance fraud vectors, are visible on open platforms and in underground forums. FVEY LE has well-developed capability to monitor and infiltrate recruitment networks.
• Recruited mules receive and transfer funds through identifiable transaction patterns: large incoming transfers, rapid forwarding to overseas accounts, minimal other account activity. Bank fraud teams flag these patterns routinely under existing AML programs.
• Mule account clusters are blockchain-forensics adjacent: where mules receive converted fiat from cryptocurrency cash-out, the fiat transaction chain connects back to ransomware wallet clusters.

Recruiter Network Organizational Structure

• Mule recruitment networks have organizational structure: recruiters, managers, money flow coordinators, and cash-out specialists. The hierarchy is documentable from communication records, transaction flows, and cooperation from arrested mules.
• Mule recruiters are OC figures, not state-protected assets. Article 210 equivalents in Western jurisdictions (RICO, conspiracy, money laundering conspiracy) are applicable where group structure is documented.

Financial Sector Cooperation

• Western banks have sophisticated AML programs and are cooperative partners for mule account identification. Bank fraud teams identify mule account patterns faster than LE in many cases.
• Payment network rules (Visa, Mastercard, Swift) provide additional leverage: mule-connected merchant accounts and payment processors can be terminated through network compliance programs independently of criminal prosecution.
• [CREDIBLE] Payment network operator engagement (Visa, Mastercard, SWIFT correspondent banks) is an underused structural lever. Correspondent banking pressure can disrupt fiat off-ramp conversion even where direct cryptocurrency enforcement is limited. Correspondent bank de-risking does not require criminal prosecution thresholds and can be initiated through regulatory referral channels, making it a lower-friction action than LE-primary tracks. Source: EDP Module 14.
• [ANALYST INFERENCE] APP (Authorized Push Payment) fraud liability reform shifts financial institution incentives toward proactively blocking mule-account activity by placing reimbursement liability on sending institutions. Where implemented (UK Payment Systems Regulator model, effective October 2024), this reform has materially increased bank-level screening of suspicious outbound payments. Advocacy for equivalent reform in FVEY partner jurisdictions represents a policy-track lever that does not require criminal prosecution thresholds and would structurally raise the cost of operating mule account infrastructure at scale. Source: EDP Module 14.

TRACK B.3, PRE-ACTION REQUIREMENTS

Track B mule networks frequently victimize the mules themselves, recruited under false pretenses, facing criminal prosecution for unwitting participation. Victim-mule identification and diversion from prosecution (where applicable) is both a justice consideration and an intelligence opportunity: victim-mules are cooperation candidates who understand recruiter communications and operational patterns.

• Mule recruitment pipeline mapping: active recruitment channels, job posting platforms, social media vectors, and romance fraud patterns, LE monitoring and private sector fraud intelligence
• Mule account cluster identification: bank fraud team cooperation to identify transaction pattern clusters consistent with mule operation, SAR data, transaction monitoring alerts
• Recruiter network hierarchy: from arrested mule cooperation and communication records, map the recruiter, manager, and coordinator tier above the street-level mule pool
• Cryptocurrency-to-fiat linkage: where mule accounts receive converted fiat, trace backward through blockchain forensics to ransomware wallet clusters, establishes the prosecution nexus
• Victim-mule assessment: distinguish unwitting mule recruits (prosecution diversion candidates and cooperation opportunities) from knowing participants

TRACK B.4, ACTION SEQUENCE

Track B is a conventional financial crime / organized crime investigation sequence. Lower complexity than Track A. FVEY LE-primary.

WARNING: Prosecuting victim-mules before cooperation opportunities are assessed wastes the most valuable intelligence source in the network. Arresting a street-level mule who was recruited under false pretenses and charging them criminally, when they could map the recruiter tier above them, is an intelligence failure, not a success.

TRACK B.5, PARTNER LANES

TRACK B.6, KPIs

TRACK B.7, ENGAGEMENT TRIGGERS TO AVOID

Cross-reference: Main Playbook §8.

REMAINING MEDIUM-TIER NODES (PHASE D)

Phases A, B, and C cover the 9 highest-impact nodes. The remaining 6 MEDIUM-tier nodes are best addressed as supporting actions integrated into the relevant higher-tier node playbooks rather than as standalone operations.

Document maintenance: review and update each node playbook quarterly, or following any major takedown, actor rebrand, significant enforcement action, or material change in VASP / infrastructure / underground market conditions. Full series review recommended at 6-month intervals to assess compounding pressure effects across all phases.