Series Monthly Activity Reports EDP monthly intelligence summaries, newest first
Series Framework Documents Core framework, 13 documents
Start here New to the framework? The Reading Order document maps the recommended sequence and dependencies between documents. Reading Order →
00
Framework Overview
Ecosystem structure, analytical approach, and document map
HTML 01
Glossary
Standardized terminology for ecosystem actors, nodes, and pressure levers
HTML 02
Ecosystem Disruption Playbook
Master disruption strategy: leverage points, sequencing, and coordination
HTML 03
Dependency Map (Refined)
Structural dependency relationships across all ecosystem nodes
HTML 04
RU Gov Protection Framework
State tolerance model: political protection mechanisms and jurisdictional leverage
HTML 05
Disruption Playbook: Phase A
Financial backbone and infrastructure: Nodes 01, 02, 03
HTML 06
Disruption Playbook: Phase B
Operational engine and obscuration: Nodes 04, 07, 08
HTML 07
Disruption Playbook: Phase C
Delivery and cash-out: Nodes 05, 06, 09
HTML 08
KPI Framework
Measurable indicators for tracking ecosystem disruption pressure
HTML 10
KPI Sourcing Plan
Data sources and collection methodology for KPI tracking
HTML 11
Group Pressure Tracking Template
Per-group template for monitoring disruption pressure indicators
HTML 12
Case Studies
Conti, QakBot, LockBit, BlackCat/ALPHV, Black Basta
HTML
Series Ecosystem Dependency Playbook Modules 15 node-level modules
M01
Stealers
Information-stealing malware: role, vendors, and disruption vectors
HTML M02
Loaders
Malware delivery infrastructure and key loader operators
HTML M03
Crypters
Obfuscation services enabling AV evasion
HTML M04
Callers
Social engineering and victim contact operations
HTML M05
Initial Access Brokers
Network access marketplace: structure, pricing, and interdiction
HTML M06
Exploit Brokers
Vulnerability and exploit supply chain
HTML M07
Ransomware-as-a-Service
RaaS platform structure, affiliate model, and pressure points
HTML M08
Leak Site Operations
Data extortion infrastructure and takedown leverage
HTML M09
Bulletproof Hosting
Resilient hosting infrastructure enabling persistent operations
HTML M10
Underground Forums
Criminal marketplace infrastructure: key forums and disruption vectors
HTML M11
Crypto Mixers
Cryptocurrency obfuscation services and financial interdiction
HTML M12
OTC Brokers
Over-the-counter crypto cash-out infrastructure
HTML M13
Money Launderers
Professional laundering networks and jurisdictional exposure
HTML M14
Mule Networks
Human cash-out infrastructure: recruitment, structure, and interdiction
HTML M15
Negotiation Services
Ransom negotiation intermediaries: role and leverage implications
HTML
Additional Supporting Materials
📄
Inside the Machine: Russian Cyber
Deep-dive background paper on Russian state-criminal cyber relationships, structural enablement, and the political economy of ransomware tolerance.