OPEN
Research · 24/7
Watching the whole machine

Ransomware Ecosystem Network Observatory

A structural analysis of Russia/CIS-linked ransomware networks: the financial flows, the infrastructure, and the jurisdictional protection that keep the whole operation running. We map where the ecosystem breaks, and how to push it there.

01 Instruments · Tools and Analysis
01 Primary Instrument · v2.6 · July 2026 Ransomware Ecosystem Map The dependency graph of the whole machine: financial flows, infrastructure, RU government protection, reconstitution pathways. June delta loaded across 10 nodes. 16 NodesJune DeltaCase StudiesTeaching Mode → 02 Interactive Simulator · Beta KRYSHA A playable disruption simulator. Spend action points on real pressure levers; the ecosystem adapts the way the framework says it does. Adaptation EngineWAIS7 Scenarios → 03 Wanted Actor Dossier · FBI · OFAC · NCA · Interpol Ransomware Most Wanted Wanted, indicted, and sanctioned principals across the ecosystem: posters, designations, rewards, confidence-labeled attribution. Includes the Evil Corp deep-dive. OperatorsSanctionsRewardsEvil Corp Dossier →
The Groups, Exchanges, and Their Infrastructure
04 Threat Actor Library Ransomware Variant Profiles 14 structural profiles: lineage, operations, affiliates, live victim data, disruption timelines. LIVE 14 ProfilesLive Data → 05 Infrastructure Layer Bulletproof Hosting 5 BPH providers: ASN infrastructure, operator attribution, disruption history. 5 ProvidersASN Maps → 06 Financial Layer Exchange Profiles 8 exchanges serving Russia/CIS networks: volumes, illicit exposure, sanctions history. 8 ProfilesSanctions →
Live Signal & Measurement
07 Live Feed Live Intelligence Feed Victim posts and active-group tracking via ransomware.live. Refreshes every 5 minutes. LIVE Real-TimeVictim Tracking → 08 Measurement KPI Tracker 9 disruption KPIs tracked quarterly since Q1 2024, rendered from the canonical registry. 9 KPIsQuarterlyWAIS →
Analysis & Reference
09 Intelligence Browser EDP Modules Node-by-node browser for all 15 Ecosystem Dependency Playbook modules. 15 ModulesInterdiction → 10 Analysis Tool · v0.1 Role Lenses Ecosystem views tuned per mission: LE, IC, financial disruption, TI, leadership. LEICFINTIEXEC → 11 Analysis Tool · v1.0 Lineage Explorer Family tree of the ecosystem: rebrand chains, affiliate migrations, code lineage. LineageRebrands → 12 Reference · v2.0 Toolkit Profiles Per-group tooling: encryptors, loaders, exfiltration utilities, infrastructure preferences. TTPsTooling →
Groups rebrand. Dependencies don’t.
The Observatory maps the structural dependencies that keep Russia/CIS ransomware running, and identifies the leverage points where targeted pressure produces measurable degradation.