The starting point for this was fairly simple: there is a pile of leaked criminal infrastructure data sitting in https://github.com/D4RK-R4BB1T/Criminal-Leaks, and I wanted to see whether looking across it would tell a more useful story than looking at each leak by itself.
Most writeups around ransomware, forums, darknet markets, and malware crews tend to focus on the exciting part: the malware family, the takedown, the actor name, the Bitcoin address, the chat leak, the "here is the IOC table" section. This is useful, but it is also a little bit like trying to understand a company by reading only its outage reports.
If you line the datasets up next to each other, the criminal underground starts to look less like chaos and more like a slightly broken platform economy. There are operators, affiliates, builders, marketplaces, comms servers, payment systems, reputation systems, and customers. There are also unpaid invoices, bad contractors, internal leaks, abandoned accounts, and support processes that sometimes look more responsive than the legitimate companies they are extorting.
The high level question goes like this:
* Who does what in this economy?
* Where are the dependencies?
* What failure modes show up again and again?
* Which parts are technically sophisticated, and which parts are just people being lazy?
The data used here comes from public leaks: Lockbit panel data, BlackBasta chats, BlackMarketReloaded Bitcoin addresses, COPP and NLCOPP forum data, ZooVille user lists, URSNIF material, and a few smaller infrastructure leaks. This is not live access, and it is not magic attribution. It is mostly parsing boring files, checking assumptions, and letting the shape of the data make the point.
Laying Out the Actors
The bird's eye view is around four roles: operators, affiliates, marketplaces, and infrastructure providers.
This is not a perfect model, but it is good enough to avoid treating everything as "the group did X". In practice, the group is usually a platform, a few core people, and a lot of semi-independent participants who may or may not be loyal this week.
Operators: The Platform People
Lockbit is a good example of the operator side of ransomware-as-a-service. The operator provides the panel, builder, payment workflow, victim negotiation infrastructure, and commission logic. Affiliates bring access and do the dirty work.
The leaked Lockbit panel gives a compact view of that relationship:
* 75 total users in the system
* 1 admin account
* 40 active affiliates
* 35 paused affiliates
* 88 generated builds
* 246 victims
* 59,975 Bitcoin addresses in the panel
* 35 affiliates with registered Bitcoin payout addresses
* 7 paid commissions
* 0 decryptions provided
That last part is where the nice business model diagram starts to look less nice.
There are 246 victims in the panel, but only 7 paid commissions and no recorded decryptions. There are several possible explanations for that, and none of them are flattering. Maybe many victims did not pay. Maybe payment tracking was incomplete. Maybe the operators were selective about paying affiliates. Maybe victims paid and still did not get working decryption. Maybe some combination of all of the above.
The important bit is not that we can prove one interpretation from this table alone. The important bit is that the incentives are unstable. Affiliates are useful only as long as they believe the operator will pay. Once that belief disappears, the same people who had access to the tooling and internal process become a leak risk.
At this stage it is tempting to describe ransomware groups as startups, but that is too generous. A startup can have broken processes and still fall back on contracts, employment law, investors, and courts. A ransomware operation has forum reputation, threats, private chats, and the hope that nobody with access gets angry enough to dump the database.
That is not a governance model. That is a countdown.
Affiliates: The Long Tail With Admin Access
The Lockbit affiliate data shows steady recruitment, but it also shows churn. Out of 75 users, 35 were paused. That is 47% of the accounts not currently active, which is a lot if you imagine this as a stable organization and less surprising if you imagine it as a contractor marketplace.
The rough lifecycle looks like this:
1. Register or get recruited.
2. Get access to the panel.
3. Generate a build.
4. Use existing access or buy access elsewhere.
5. Deploy ransomware.
6. Negotiate through the platform.
7. Wait for a commission, in theory.
Build creation follows the usual power-law shape. There were 23 unique builders behind 88 builds, but only a handful drove most of the volume. Most participants generated one or two builds, which could be testing, failed campaigns, or low-volume operations. A smaller core did the real work.
This matters for defenders because "75 users" is not the same thing as "75 equally important operators". The useful target is the small set of people and workflows that keep the platform productive. The rest is noise, churn, and people trying to get rich with someone else's builder.
It also matters because the long tail is probably where a lot of the bad operational security lives. The core people might understand compartmentalization, or at least have learned by getting burned. The occasional affiliate is more likely to reuse handles, connect from home, paste the wrong thing into the wrong chat, or complain publicly when they do not get paid.
Marketplaces: Liquidity For Bad Ideas
BlackMarketReloaded sits in an older era, around the post-Silk-Road marketplace world. The leak contains 108,194 Bitcoin addresses, almost all legacy P2PKH addresses, which fits the 2013-2014 timeframe.
For comparison, the Lockbit panel had 59,975 Bitcoin addresses. The address counts are not directly comparable because the systems and years are different, but the scale is useful. These operations were not manually copying addresses from a wallet UI. They had automated address generation, order or victim separation, and enough workflow around payments that the wallet infrastructure became part of the product.
Marketplaces are the connective tissue. They make the rest of the economy easier to assemble:
* stolen data sellers find buyers;
* initial access brokers find ransomware affiliates;
* malware developers find packers and obfuscation services;
* cash-out specialists find people who need cryptocurrency turned into something spendable;
* reputation systems let strangers make just enough trust decisions to transact.
This is where the underground resembles a normal platform economy most closely. The marketplace does not need to commit every crime itself. It needs search, listings, escrow or pseudo-escrow, reputation, messaging, and enough dispute handling to keep fees flowing.
Of course the problem is that dispute handling in a criminal market is mostly spectacle. If enough money disappears, the final appeal process is doxing, leaking, or rebranding.
Infrastructure Providers: The B2B Layer
The less visible part of the ecosystem is the supplier layer. Ransomware crews and forums need hosting, chat, crypting and packing, wallet automation, Tor hidden services, domain registration, and a steady flow of disposable infrastructure.
BlackBasta, for example, used a self-hosted Matrix server. That is a sensible choice from their perspective. Commercial chat providers can receive legal requests and suspend accounts. Self-hosted chat gives more control, but also creates a juicy central point of failure. If the server or backups leak, the organization leaks with it.
Lockbit and BlackMarketReloaded both show large-scale Bitcoin address management. That is specialized engineering. It might be custom code, it might be a library glued into a panel, but either way someone had to make payment operations work at scale.
Tor hidden services are another example. They look anonymous from the outside, but the private keys and deployment process become crown jewels. Once those keys are leaked, the hidden service identity is burned. Any trust attached to that address burns with it.
This is one of the more useful defender takeaways: infrastructure is not just an indicator source, it is an organizational dependency. When a group self-hosts, automates wallets, or relies on a particular supplier, it creates places where disruption has effects beyond a single malware sample.
Forums And Fringe Communities: Same Mistakes, Different Crime
The COPP, NLCOPP, and ZooVille data is not ransomware data, but it is still useful because the human failure modes rhyme.
COPP had 387,392 accounts and 88,154 connection logs. ZooVille had more than 71,000 user records. Between ZooVille and COPP, there were 3,851 shared usernames. Between COPP and NLCOPP, there were 1,050 shared usernames, around 27.7% of the NLCOPP user base.
This is not advanced correlation. It is string matching.
That is exactly the point. A lot of exposure does not require clever graph analytics or a classified dataset. People reuse handles because they want continuity, recognition, convenience, or because they simply do not think about it. Once one platform leaks, the same handle becomes a thread you can pull across other communities.
The IP data is even less glamorous and more damaging. In the COPP logs, 99.5% of connections were residential ISP connections. Only 3 connections were classified as VPN usage.
That number is almost funny until you remember what it means. These were users of communities that should have been paranoid by default, and nearly everybody was connecting from normal home internet.
Security advice loses to convenience, again.
Where It Breaks
The failure modes are depressingly consistent.
Payment disputes create leaks. Operators can promise affiliates a percentage, but there is no court where an affiliate can recover unpaid commission. If the operator stops paying, the affiliate's leverage is reputational damage, leaking internal data, or attacking the operator.
That is what made the URSNIF material interesting: the leak was not only a technical event, it was a labor dispute in a criminal business. Someone believed they were owed something, and the enforcement mechanism was exposure.
Counter-hacking burns infrastructure. Criminal groups target each other for money, reputation, rivalry, or entertainment. When that happens, private keys, panels, chats, and databases become trophies. The practical result is the same as a law enforcement seizure in one respect: infrastructure that was trusted yesterday becomes unusable today.
Exit scams poison future markets. ExposedForums reportedly exits with users' money, then the same ecosystem reappears under another brand, then the new brand scams its own affiliates. This sounds absurd until you remember there is no regulator, no refund process, and no durable identity beyond reputation. Rebranding is cheap. Trust recovery is not.
Builder leaks fragment operations. Once a ransomware builder leaks, the operator does not merely lose exclusivity. The tooling can create copycat variants, confuse attribution, and spin up low-quality campaigns under adjacent names. Lockbit's history with leaked and copied builders is a good example of how control does not disappear cleanly. It splinters.
The common thread is simple: the technology can be professional, but the trust model is terrible.
The PGP And Reputation Problem
Criminal forums use reputation because they have to. Registration age, vouches, post count, transaction feedback, signed messages, and PGP keys all become substitutes for legal identity.
PGP is especially interesting because it gives a portable identity. If a user signs a message with the same key across forums, buyers can treat that as continuity. If the private key leaks, the continuity turns into a liability. Anyone with the key can impersonate the identity, and the old reputation becomes suspect.
Forum reputation has the same problem at a social level. It takes time to build and can disappear in one ugly thread. A failed escrow, an accusation, a leaked chat, a missing payout, or an exit scam can collapse years of credibility. The dispute process is public argument plus whatever screenshots people decide to post.
This is why leaks are not rare accidents in this ecosystem. They are one of the few enforcement mechanisms available.
If you cannot sue, you leak.
Cross-Dataset Things That Were Worth Checking
Some of the more useful findings came from metadata, not content.
The Lockbit and BlackMarketReloaded Bitcoin datasets had 168,169 total addresses with zero overlap. Lockbit was 100% segwit-native in the analyzed set, while BlackMarketReloaded was 99.97% legacy. Even before doing transaction graph work, the address formats tell you something about era, tooling, and compartmentalization.
The username overlaps were also useful. ZooVille to COPP produced 3,851 shared handles. COPP to NLCOPP produced 1,050. These are not proof that any one account belongs to the same human without more context, but they are excellent triage leads.
The BlackBasta chat timing was another good example. The 195,881 messages peaked around 12:00 UTC, which is 3:00 PM Moscow time. That does not prove location by itself, but it does show an operational rhythm. People have workdays, even when the work is crime.
Lockbit negotiation response time was also striking. Median response was around 3.5 minutes. That is not a casual mailbox someone checks twice a day. That implies process, alerting, dedicated staff, automation, or some mix of those.
Again, none of this requires a Hollywood interface. It is mostly counting, grouping, and being disciplined about not overclaiming.
Takeaways For Defenders
The first takeaway is to study the system, not just the malware. Malware changes quickly, but roles and incentives are stickier. Operators need affiliates. Affiliates need payment. Markets need reputation. Infrastructure needs maintenance. Every dependency is a place where pressure can produce intelligence.
The second takeaway is that payment disputes are useful signals. When affiliates complain, something is already breaking. Those complaints can precede leaks, rebrands, or splinter groups.
The third takeaway is that metadata is often enough to start. Address formats, username reuse, ISP classification, chat timing, and builder counts can reveal structure without needing to read every message or reverse every binary.
The fourth takeaway is that OPSEC failure is normal. We like to talk about the careful actors because they are hard. The bulk of many communities is not careful. COPP's 99.5% residential connection pattern is a reminder that most people choose convenience almost all the time.
The fifth takeaway is that criminal infrastructure is fragile in boring ways. It fails because people do not get paid, keys leak, forums burn reputations, admins rebrand, builders escape, and users reuse handles.
That is good news for defenders, because boring failures are measurable.
So What Did This Actually Show?
The underground economy is structured, but not stable.
It has platforms, but weak governance. It has contractors, but no enforceable contracts. It has reputation, but reputation is easy to poison. It has cryptographic identity, but private keys leak. It has payment automation, but payments still become disputes. It has self-hosted infrastructure, but that just moves the breach target closer to the operators.
The Lockbit panel numbers are a good summary of the whole thing: 75 users, 88 builds, 246 victims, 59,975 Bitcoin addresses, 7 paid commissions, and 0 decryptions recorded.
That is not just a ransomware dataset. That is a broken business process with malware attached.
For defenders, the lesson is not "wait for criminals to make mistakes" in the abstract. The lesson is to map the roles, find the dependencies, and watch the trust boundaries. The leaks will keep happening because the trust problem is not a bug in this economy. It is part of the design.
Data Sources
* Lockbit panel database: users, builds, victims, Bitcoin addresses, commission records
* BlackBasta internal communications: 195,881 messages across 79 rooms and 50 participants
* Lockbit negotiations: 3,087 messages
* BlackMarketReloaded: 108,194 Bitcoin addresses
* COPP: 387,392 accounts and 88,154 IP logs
* NLCOPP: 4,856 users
* ZooVille: 71,017 email addresses and 71,497 usernames
