Feature · the protection layerThe Roof Has Windows
Everyone knows the Russian state shelters its ransomware crews. What gets less attention is that it also watches them: formally, comprehensively, and without a court order. Once you see the surveillance, tolerance stops being a plausible story.
Read the dispatch →
The Long Cash-Out: how a ransom becomes rubles
The seven moves that turn a victim's payment into spendable money, and the few places that money is thin enough to break.
After Garantex: where the cash-out moved next
The takedown was real. The plumbing rerouted in days. The settlement layer underneath has not moved at all.
The Bloodline
Every major Russian ransomware brand since 2007 descends from a small circle of men who knew each other before 2014. Track the people and the chaos resolves into a family tree. Seven parts. Named, sourced, and graded.
The Protected: the named, graded.
Ninety-six named and graded. Who holds the roof, who stands under it, and what it would take to make the arrangement expensive. The first four are unsealed, with more to follow.
Enter The Protected →
The Roof Has Windows
SORM, Rosfinmonitoring, the Central Bank, the tax service: total visibility, and what it proves about protection. 31 Jul 2026 · 15 min
The Long Cash-Out: how a ransom becomes rubles
The seven moves that turn a payment into spendable money, and where the chain is thinnest. 9 Jul 2026 · 19 min
After Garantex: where the cash-out moved next
Three brand changes, one unmoved settlement layer. 18 Jun 2026 · 11 min
Operation Endgame: the layer it cannot reach
What the best disruption campaign in the business deliberately leaves alone. 19 Jun 2026 · 10 min
The Common Ancestor
Zeus, the Business Club, and the circle that started it all. 2007 to 2014. 3 Jul 2026 · 10 min
A Lamborghini Named Thief
Yakubets and the Evil Corp years. 2014 to 2019. 3 Jul 2026 · 13 min
The Roof Over Evil Corp
Benderskiy, the FSB, and the protection made visible. 2019 onward. 3 Jul 2026 · 14 min
The Corporation
Stern and the Trickbot/Conti machine. 2016 to 2022. 3 Jul 2026 · 12 min
The Diaspora
Black Basta, Royal, and where Conti's people went. 2022 onward. 3 Jul 2026 · 13 min
The Parallel Track
GandCrab, REvil, DarkSide, LockBit. A separate root, never leaked. 2018 onward. 3 Jul 2026 · 14 min
The Constants
Series conclusions: the money, the metal, the krysha. What survives every rebrand. 3 Jul 2026 · 15 minEnd Krysha is an independent threat intelligence publication, the public face of a longer research program: mapping the dependencies that keep Russia and CIS ransomware operations alive, and identifying the pressure points where targeted enforcement produces measurable degradation. Every dispatch is sourced and carries analytic confidence labels.
Groups rebrand. Dependencies don't. Ransomware doesn't run on malware; it runs on a krysha: the roof the Russian state holds over its crews while the money moves and the servers stay up. We find the roof, we document how it works, and we map where it is weakest.
Have a tip, a lead, or a correction?
Leads, data, source documents, and pushback on the analysis are all welcome, and so are reading recommendations for the shelf. Confidentiality respected.