Inside the markets that don't advertise
The high-value trade has migrated off the indexed marketplaces into invitation-only channels. A field map of where the goods actually move.
Read brief →Declassified excerpts from our threat research desk. The full briefs are reserved for clients — but the signal here is real, and it is moving.
The most capable crews have professionalized: affiliate payrolls, negotiation playbooks, even customer-service desks for victims. We dissect the unit economics of a modern ransomware-as-a-service operation — and where the model is quietly breaking.
Read briefThe high-value trade has migrated off the indexed marketplaces into invitation-only channels. A field map of where the goods actually move.
Read brief →Synthetic voice and video have crossed the threshold of board-level credibility. How a single live deepfake authorized an eight-figure transfer.
Read brief →Chain-hopping, mixers and instant-swap rails compress the laundering cycle to minutes. Where the trail still survives — and how we follow it.
Read brief →Adversaries no longer attack the fortress — they compromise the supplier with the keys. A pattern analysis of third-party intrusion.
Read brief →Generative models have industrialized social engineering — flawless lures, at scale, in any language. What changes for the defender.
Read brief →A reconstructed timeline of a business email compromise — from the first spoofed inbox rule to the funds frozen in nine jurisdictions.
Read brief →Full briefs, named-threat dossiers and live indicators are reserved for clients.
Request full access