AFTRDRK/DRKCACHE
Threat intelligence platformAsk anything, any hour.Every answer has receipts.
DRKCACHE is the conversational layer over AFTRDRK's intelligence holdings. Ask the way you'd ask a colleague. The answer arrives with the evidence attached.
Who is ADV0088 and should we care?
Yes. It is the most consequential extortion threat to your sector right now.
ADV0088 runs the KRYPTIK program and does not conduct its own intrusions. It buys access, most consistently from ADV0074. Extortion is double: exfiltrate, then encrypt, with a seven-day window. Since June it publishes proof of listing two days before the deadline.
victim
sector payments / integration services
region Western Europe
volume 640 GB · available now
Ask a question…
DRKCACHE · Ask · illustrative data
Three places.No query language.
Built for the analyst producing intelligence. Legible to the SOC analyst with an alert in hand, and to the security leader reading the top of a report.
Every tool the answer used appears inline: which records, which detections, which reports. Expand any of them to see the underlying source.
Who they are, what they buy, what they run, who they hit, and where your estate sits on their route. Search every adversary we track, or start with the ones most likely to come for you.
Easy to consume, easy to act on, tagged to your organization's priority intelligence requirements.
One namethat never changes.
Every tracked adversary carries an ADV designator, assigned once and never reused. Brands change. Ransomware programs rebrand. Leak sites move. The designator follows the people, and the names other vendors and the press use are cross-referenced beside it.
- Designators encode nothing that can go stale
- Actor-chosen brands recorded, never conflated
- Common names from other reporting indexed for search
Adversaries
Relevant to your profile · 5Search actors, programs and malware by name, alias or class
- ADV
0088ADV0088runs KRYPTIKBuys access, extorts twice. 31% of disclosures in payments.
Updated today2h - ADV
0074ADV0074access brokerSells domain admin into finance and healthcare. Escrow only.
Access broker1d - ADV
0061ADV0061loader-as-a-serviceMalvertising into stealer infections. Feeds three programs.
Malware3d - ADV
0126ADV0126skimmer panelsCheckout injection on shared hosting. New reseller in August.
Updated yesterday1d - ADV
0042ADV0042claims, then leaksPublicity first. Overstates every haul. Sometimes real.
Hacktivist6d
When the answerisn't there yet.
If DRKCACHE doesn't have the answer, it tells you plainly instead of guessing. Then it turns your question into a request for intelligence, and our analysts go and collect it, with priority.