The full running log of the Signals wire. Every item we have flagged, in reverse order, dated, tagged to the dependency it touches, and graded by source reliability. The homepage carries the latest batch; nothing is deleted here.
Why it matters: the payment leg is now being attacked from inside. An affiliate soliciting victims as a recovery vendor is stealing from the operators rather than from the victims, and it corrodes the one thing a ransomware-as-a-service brand actually sells to its affiliates: a settlement process that pays out.
Why it matters: domain and server seizure is the main lever anyone has against the metal. Putting the chat proxy and the leak posts in a Polygon contract is a deliberate attempt to make that lever miss. Worth watching for adoption: if this spreads, takedown counts stop measuring what they used to measure.
Why it matters: after Garantex and A7A5, the improvised rails kept breaking under sanction. A licensing regime run by the central bank, with the domestic payment ban left intact and use in foreign trade explicitly permitted, is the state building a supervised replacement. Supervision is not tolerance. It is visibility, and visibility is the argument.
Why it matters: arrested in Poland in 2023, extradited in 2024, sentenced now. Every conversion of a Russian-speaking principal into a prison sentence has run through a third country, because the ones who stay home are unreachable. The pipeline works. It just cannot start inside Russia.
Why it matters: no encryption, pure data theft at scale: the MOVEit and Cleo playbook run against another enterprise platform. With payment rates at record lows, volume extortion is how a crew holds revenue while conversion collapses. Watch for bulk leak-site listings.
Why it matters: the parent filed an 8-K on 16 Jul and halted US dairy production before the leak-site listing even appeared. The pressure model now runs through securities law and supply chains, not countdown timers. The claimed 1TB is the group’s assertion, not a fact.
Why it matters: the first sanctioning body to put the moniker on paper. Kovalev already sits in The Protected; the public record is catching up while he stays beyond reach in Russia. His personal cut alone would make him the most prolific ransomware operator ever identified.
Why it matters: a rare full negotiation with the payment traced: $3M demanded, $1M paid in bitcoin, no verifiable deletion. This is the payment layer seen from inside, and why proof of deletion is worthless as a product. The victim identification (Union County, Ohio) rests on file names in proof-of-theft samples.
Why it matters: treat the number as an assertion, not a fact. The signal is Qilin's volume: post-RansomHub affiliate consolidation continues to concentrate in one brand.
Why it matters: names on an indictment, bodies in St. Petersburg. The hosting served LockBit, BlackSuit, and Play. The charge is two years old and no defendant has faced a courtroom: that is the krysha measured in real time. Watch whether any of the three ever travels.
Why it matters: volume up, conversion down. About 28 percent of victims paid in 2025, the lowest share recorded, and H1 2026 attack counts set new highs. The money layer is the one measurably degrading.
Why it matters: sanctions are moving down the stack, from operators to the anonymity layer. The cryptor-seller designation matters more than the VPN: crypting is a chokepoint enforcement has barely touched.
Tips, leads, and corrections are welcome, and so is pushback on any grading. Confidentiality respected. Use the address on the right.