The full running log of the Signals wire. Every item we have flagged, in reverse order, dated, tagged to the dependency it touches, and graded by source reliability. The homepage carries the latest batch; nothing is deleted here.
Why it matters: no encryption, pure data theft at scale: the MOVEit and Cleo playbook run against another enterprise platform. With payment rates at record lows, volume extortion is how a crew holds revenue while conversion collapses. Watch for bulk leak-site listings.
Why it matters: the parent filed an 8-K on 16 Jul and halted US dairy production before the leak-site listing even appeared. The pressure model now runs through securities law and supply chains, not countdown timers. The claimed 1TB is the group’s assertion, not a fact.
Why it matters: the first sanctioning body to put the moniker on paper. Kovalev already sits in The Protected; the public record is catching up while he stays beyond reach in Russia. His personal cut alone would make him the most prolific ransomware operator ever identified.
Why it matters: a rare full negotiation with the payment traced: $3M demanded, $1M paid in bitcoin, no verifiable deletion. This is the payment layer seen from inside, and why proof of deletion is worthless as a product. The victim identification (Union County, Ohio) rests on file names in proof-of-theft samples.
Why it matters: treat the number as an assertion, not a fact. The signal is Qilin's volume: post-RansomHub affiliate consolidation continues to concentrate in one brand.
Why it matters: names on an indictment, bodies in St. Petersburg. The hosting served LockBit, BlackSuit, and Play. The charge is two years old and no defendant has faced a courtroom: that is the krysha measured in real time. Watch whether any of the three ever travels.
Why it matters: volume up, conversion down. About 28 percent of victims paid in 2025, the lowest share recorded, and H1 2026 attack counts set new highs. The money layer is the one measurably degrading.
Why it matters: sanctions are moving down the stack, from operators to the anonymity layer. The cryptor-seller designation matters more than the VPN: crypting is a chokepoint enforcement has barely touched.
Tips, leads, and corrections are welcome, and so is pushback on any grading. Confidentiality respected. Use the address on the right.