AFTRDRK/AFTRMATH
Threat intelligence analysisAFTRMATHWritten after dark.
The part of our work we can talk about.
Silent Ransom Group: when the intrusion fails, they send a personSilent Ransom Group pairs callback phishing with people on the ground, cultivated insiders and plans that reach well past data extortion.AFTRMATH 004 · 8 minRead →The Handala hindsight: how three years of warning signs led to the Stryker wipeThe Iran-linked persona Handala wiped Stryker's devices through Microsoft Intune in March 2026. Three years of operations in Israel showed it coming.AFTRMATH 003 · 9 minRead →Scraping the darknetThe structure and defenses of underground forums where stolen data is traded and access is sold, and what it takes to collect from them at scale.AFTRMATH 002 · 4 minRead →US Treasury sanctions Russian zero-day brokerOn February 24, 2026, the U.S. issued the first sanctions under PAIPA, against Russian exploit broker Operation Zero and its affiliates.AFTRMATH 001 · 3 minRead →