Skip to content
03 / Intelligence

What we're tracking.

Declassified excerpts from our threat research desk. The full briefs are reserved for clients — but the signal here is real, and it is moving.

Intelligence reports

Abstract red-tinted visualization of a ransomware network

Ransomware · 24 Jun 2026 · 9 min read

The ransomware economy has a CFO now.

The most capable crews have professionalized: affiliate payrolls, negotiation playbooks, even customer-service desks for victims. We dissect the unit economics of a modern ransomware-as-a-service operation — and where the model is quietly breaking.

Read brief

Inside the markets that don't advertise

The high-value trade has migrated off the indexed marketplaces into invitation-only channels. A field map of where the goods actually move.

Read brief →

The CEO on the call was not the CEO

Synthetic voice and video have crossed the threshold of board-level credibility. How a single live deepfake authorized an eight-figure transfer.

Read brief →

Laundering at the speed of a block

Chain-hopping, mixers and instant-swap rails compress the laundering cycle to minutes. Where the trail still survives — and how we follow it.

Read brief →

The breach you inherited from a vendor

Adversaries no longer attack the fortress — they compromise the supplier with the keys. A pattern analysis of third-party intrusion.

Read brief →

When the scam writes itself

Generative models have industrialized social engineering — flawless lures, at scale, in any language. What changes for the defender.

Read brief →

The anatomy of a $40M wire fraud

A reconstructed timeline of a business email compromise — from the first spoofed inbox rule to the funds frozen in nine jurisdictions.

Read brief →

Full briefs, named-threat dossiers and live indicators are reserved for clients.

Request full access