Cyber threat intelligenceOthers seethe mask.We seethe face.
A handle is a costume. Behind it is a person, with habits, a payment trail and a history they cannot delete. AFTRDRK works where attacks are prepared, names who is behind them, and tells you before it is public.
Who is ADV0088 and should we care?
Yes. It is the most consequential extortion threat to your sector right now.
ADV0088 runs the KRYPTIK program and does not conduct its own intrusions. It buys access, most consistently from ADV0074. Extortion is double: exfiltrate, then encrypt, with a seven-day window. Since June it publishes proof of listing two days before the deadline.
victim
sector payments / integration services
region Western Europe
volume 640 GB · available now
Ask a question…
DRKCACHE · every answer arrives with its receipts · illustrative data
Indicators tell you what happened.We tell you who.
Handles, hashes and IP addresses change every week. Habits, money and old mistakes don't. That is what we follow, and it is why our answer has a name and a confidence grade on it.
The mask
What a feed gives you- Handlevex_r
- IP address203.0.113.47
- Hash9f2c41…e1a0
- Leak sitekryptik…onion
- Note"7 days. Then everything."
Rotates by next week.
The face
What AFTRDRK gives you- DesignatorADV0088 · runs KRYPTIK
- History4 handles, 3 forums, since 2016
- Accessbought from ADV0074, escrow only
- Personnamed · jurisdiction known
- Sanctionsscreened · no nexus found
Confidence: high · 4 of 5 rungs · gaps stated · illustrative record
Three ways in.One collection behind all of them.
Our collection reaches the forums, markets, messaging channels and leak sites where access is priced and victims are named, including the ones that only vouched cybercriminals can enter. Everything we sell draws on it.
02.1DRK Web Surveillance
Know beforeit's public.
Your credentials, domains, suppliers and executives, watched every night. Findings arrive translated, ranked, and tied to an outcome you can close. Not a thousand alerts. The few that matter.
- Brand and domain protection
- Supply chain exposure
- Credentials and stealer logs
- Ransomware and leak-site listings
- Executives and insiders
From $2,000 a month · every plan has every feature · 30 days free
Your exposure is low. Two of three areas aren't watched yet.
Leaked passwords on your domains and your servers in attacker tooling make up most of the score. Turn them on to start watching them.
Turn them onNeeds your attention 3 items
Domain admin access to a US healthcare network matching your vendor is offered for $18,000
Criticalaccess-broker forum · 23:17Z · Supply chain vendors from Russian
Vendor contacted412 employee credentials in a fresh stealer log. 38 still valid.
Highstealer log · 23:41Z · Your domains
Passwords resetA phishing kit that clones your login page is offered for $450
HighTelegram · 00:06Z · Your brand
Domain taken down02.2DRKCACHE
Ask anything, any hour.Every answer has receipts.
Ask in plain language, day or night. DRKCACHE answers from everything AFTRDRK has collected and analyzed, and cites the detections, reports and adversary records behind each answer. Every tracked adversary carries a designator that never changes, even when the brand on the note does.
- Live target packages per adversary
- Flash reports and intelligence briefs
- Priority requests for intelligence
- Raw detections behind every claim
Adversaries
Relevant to your profile · 5Search actors, programs and malware by name, alias or class
- ADV
0088ADV0088runs KRYPTIKBuys access, extorts twice. 31% of disclosures in payments.
Updated today2h - ADV
0074ADV0074access brokerSells domain admin into finance and healthcare. Escrow only.
Access broker1d - ADV
0061ADV0061loader-as-a-serviceMalvertising into stealer infections. Feeds three programs.
Malware3d - ADV
0126ADV0126skimmer panelsCheckout injection on shared hosting. New reseller in August.
Updated yesterday1d - ADV
0042ADV0042claims, then leaksPublicity first. Overstates every haul. Sometimes real.
Hacktivist6d
02.3Threat actor engagement
When they come for you,they get us.
We take over the conversation. You never speak to them. Attribution runs while they talk, so the decision is made knowing who is on the other side. The decision stays with you.
- A human within 30 minutes, any hour
- Every counterparty screened against sanctions lists
- A fixed fee, agreed before we begin
| 02:14 | Note found. Your team contacts the desk. |
|---|---|
| 02:31 | A human on the line. Counsel looped in. Nothing sent to them. |
| 03:05 | First message to the actor leaves from us. Their deadline is ignored. |
| 03:40 | Handle matched to ADV0088 · prior matter on file |
| 04:12 | Counterparty screened. No sanctions nexus. |
| 08:00 | Options briefed in plain language. The decision stays yours. |
Outcomes.Not alerts.
The actor behind the handle, with a confidence grade and the evidence chain behind it.
Your access, credentials or vendor on sale, in front of you before it is in the news.
When they come for you, the conversation is ours, and so is the clock.
Anonymity is a habit.Habits leave patterns.
Attribution at AFTRDRK means a named actor, a confidence grade, and an evidence chain you can rely on. We grade every source. We show where the evidence stops. A blank record gets a blank answer; we never fill silence with a famous name.
| R1 Handle | vex_r · posting hours cluster to UTC+3 · same typo in every note |
|---|---|
| R2 Identifier | messaging ID reused since 2016 · three forums, one ID |
| R3 Infra | builder hash matches a 2021 leak · same registrar for C2 |
| R4 Payment | wallet cluster co-spends with a 2022 matter |
| R5 Person | name on file · two aliases · email seen in a 2019 combolist |
| Assessment | likely · high confidence · 4 of 5 rungs resolved · gaps stated |
- R1Handle
- R2Identifier
- R3Infra
- R4Payment
- R5Person
Built for the peoplewho own the outcome.
CISOs and intelligence teams use us before anything happens. When something does, we work for the organization and the people it hit.
One brief your board can read. Exposure, adversaries, and what changed this week.
Sourced answers, raw detections, and analysts to task when the answer isn't there yet.
When they come for you, we take the conversation and work for you alone. Our record holds up when someone asks how you knew.
We take the actor. You keep the client, the recovery, and the credit.
AFTRMATHWritten after dark.
The part of our work we can talk about.
Discreet by design.Easy to verify.
Our operators work out of sight, because the people we track read websites too. Before you sign, you meet the leadership accountable for your work, and your counsel can inspect our controls.
You meet our leadership before you sign, and you know who answers for your work. Our operators stay out of sight, and that protects your case.
Fixed fee, agreed before we begin. Nothing to gain from a longer incident.
We run a material attribution on every counterparty before anything changes hands. A sanctions nexus ends it.
Your counsel can review our insider-risk controls before you sign.
Find out what theyalready know about you.
Leave a work email. We put together a short brief on what is circulating about your organization right now: access for sale, credentials, your name in the wrong channels. Then we walk you through it on a call.
Received. We'll be in touch to set up a call and walk you through your brief. If attackers have already contacted you, engage the desk instead.