AFTRDRK/Attribution
Threat actor attributionAnonymity is a habit.Habits leave patterns.
They change handles, wallets, infrastructure and brands. They can't change the fingerprints they leave behind. We follow those until the pattern has a name.
| R1 Handle | vex_r · posting hours cluster to UTC+3 · same typo in every note |
|---|---|
| R2 Identifier | messaging ID reused since 2016 · three forums, one ID |
| R3 Infra | builder hash matches a 2021 leak · same registrar for C2 |
| R4 Payment | wallet cluster co-spends with a 2022 matter |
| R5 Person | name on file · two aliases · email seen in a 2019 combolist |
| Assessment | likely · high confidence · 4 of 5 rungs resolved · gaps stated |
- R1Handle
- R2Identifier
- R3Infra
- R4Payment
- R5Person
Four answers.Graded.
Sixty-six intelligence requirements across seven categories, correlated against our intelligence holdings. What sits inside them stays with us.
The operation and the people behind it, with our confidence stated.
And what it does to your options.
Money, access, leverage, or something they'd rather you didn't know.
Transactional, credibility and reliability risk. Plainly.
What werefuse to do.
We never fill silence with a famous name.
You see where the evidence stops.
Every source carries its grade.
When it hasto be right.
Know who is on the other end before money moves.
A record that holds up when someone asks how you knew.
Attribution without building an intelligence unit.
Bring us the mask.We'll find the face.
A handle, a ransom note, a wallet, a listing. Tell us what you have and we'll tell you what it can become.