The Observatory

Debut at scale. The successor's first month is already at operating volume. Across brands with 25 or more claims the median first month is claims and the median brand debuts at of its eventual peak, so arriving fully formed is rare. Two conditions must both hold: at the brand's own ceiling and at the predecessor's operating scale, because a brand that posts once and vanishes trivially satisfies the first. Caught conti to royal, where royal opened at 43 claims, 10.8 times conti's median month.

Baton pass. The successor's share of the pair's combined monthly volume moves from near zero to near one while the predecessor gives way. Scale-free by construction, which is the point: blacksuit opened at 3 claims against an eventual 34, so any measure relative to its own peak reads that as noise even though royal was collapsing from 25 to 1 in the very same months. A novelty gate suppresses brands that were already running at scale and simply carried on when a big one died.

Shared victims. The same victim claimed by both brands. The weakest signal despite looking like the strongest. One affiliate posting to two panels, two crews extorting the same victim independently, both buying from the same access broker, and outright false claims all produce it. It is also completely absent from the clearest rebrand in the data: royal and blacksuit share zero victims.

Targeting continuity. Country and sector mix carrying over. Nonzero on 98.8 percent of eligible pairs, because almost every brand hits a US-heavy manufacturing and services mix, so its bar sits at the 95th percentile and it never orders this list and can never carry a lead alone.

Recorded. What the source file states. The only non-inferred tier, and sparse: 14 links. It does not record royal to blacksuit or blacksuit to chaos, so absence here means nothing.

Ranking is strength first, corroboration second: the strongest fired signal plus 35 percent of the others. Counting signals instead would let three weak ones outrank one decisive one. Thresholds sit at each signal's own distribution across all eligible pairs, so a badge means unusual, not merely present.

Validation, and why the flattering number was thrown out. Scoring against the lineage field inside the ransomware.live file returns 10 of 10, but that field is itself derived from leak-site data, so the test is partly circular. The honest test is this site's own curated lineage file, which is built from vendor reporting and code analysis independently of posting patterns. Those results are below and they are much more modest.

Two structural limits that number exposes. First, the curated file records code lineage as well as operational handoff. An edge like "Crysis derived from Dharma" describes malware ancestry and leaves no signature in posting behaviour whatsoever; this tool measures when an operation moves between brands, which is a different question. Second, most curated edges cannot be tested at all, because the brands predate leak sites or never posted enough to score. That is a coverage ceiling, not a tuning problem.

What it cannot do. Identify people. Separate a rebrand from an affiliate migration, or either from two unrelated crews with similar targeting. Detect a successor that never posted, or one below the 8-claim scoring floor. Confidence does not accumulate along a chain: each step is an independent lead, so a four-brand chain is less certain than any single step in it, not more.