Feature · the protection layerThe Roof Has Windows
Everyone knows the Russian state shelters its ransomware crews. What gets less attention is that it also watches them: formally, comprehensively, and without a court order. Once you see the surveillance, tolerance stops being a plausible story.
Read the dispatch →
The Long Cash-Out: how a ransom becomes rubles
The seven moves that turn a victim's payment into spendable money, and the few places that money is thin enough to break.
Operation Endgame: the layer it cannot reach
What the best disruption operation in Europe achieved, and the one dependency it left standing.
The Bloodline
Every major Russian ransomware brand since 2007 descends from a small circle of men who knew each other before 2014. Track the people and the chaos resolves into a family tree. Seven parts. Named, sourced, and graded.
The Roof Has Windows
SORM, Rosfinmonitoring, the Central Bank, the tax service: total visibility, and what it proves about protection. 31 Jul 2026 · 15 minThe Long Cash-Out: how a ransom becomes rubles
The seven moves that turn a payment into spendable money, and where the chain is thinnest. 9 Jul 2026 · 19 minOperation Endgame: the layer it cannot reach
What the best disruption operation in Europe achieved, and the one dependency it left standing. 19 Jun 2026 · 10 minAfter Garantex: where the cash-out moved next
Three brand changes, one unmoved settlement layer. 18 Jun 2026 · 11 minSeries parts are listed once, in The Bloodline above.
End Krysha is an independent threat intelligence publication, the public face of a longer research program: mapping the dependencies that keep Russia and CIS ransomware operations alive, and identifying the pressure points where targeted enforcement produces measurable degradation. Every dispatch is sourced and carries analytic confidence labels.
Groups rebrand. Dependencies don't. Ransomware doesn't run on malware; it runs on a krysha: the roof the Russian state holds over its crews while the money moves and the servers stay up. We find the roof, we document how it works, and we map where it is weakest.