Nova’s catalogued 22 April offer starts a partner at 75%, lifts the share with tenure and attaches 95% to a 1M revenue threshold, with currency unstated. A headline split is therefore a contract with conditions. Other selected offers price a portal separately or make the affiliate conduct the talks.
The collected claim series answers a different question: 33 of 177 groups account for 5,950 of 9,203 canonical claims, or 64.7%, while appearing in at least eight months. This chapter connects the advertised division of work with that concentrated public output, without treating an ad as proof of an intrusion.
- 9,203De-duplicated leak-site claimsSource: Brandefense Blackhole, 1 Jan–27 Oct 2026; claims are canonical group–victim pairs; recruitment items from the edited 60-item catalogue, first-seen dates
- 177Group labels after spelling-variant mergesSource: Brandefense Blackhole, 1 Jan–27 Oct 2026; claims are canonical group–victim pairs; recruitment items from the edited 60-item catalogue, first-seen dates
- 33Groups active in at least eight observed monthsSource: Brandefense Blackhole, 1 Jan–27 Oct 2026; claims are canonical group–victim pairs; recruitment items from the edited 60-item catalogue, first-seen dates
- 12Recruitment items in the edited catalogueSource: Brandefense Blackhole, 1 Jan–27 Oct 2026; claims are canonical group–victim pairs; recruitment items from the edited 60-item catalogue, first-seen dates
What Crews Offer Their Partners
Start with the money. In a ransomware-as-a-service deal, the crew supplies the locker, the panel and the leak site, and an affiliate breaks into the victim. The ads say how the ransom is divided.
The Gentlemen offered 90% with a proof-or-deposit entry rule. KittyKatKrew also advertised 90%, while FLOCKER added a $170 invitation fee. The affiliate-terms investigation compares what those conditions require from an applicant.
The catalogued Gunra offer keeps a 15% operator fee, implying an 85% partner share, with a lower fee possible depending on the target. The retained CRPX0 programme clause promises the partner a 70% commission on every successful payment. These are promises to participants, not observed payouts.
Six programme ads state or imply a split. CRPX0 offers the lowest of those, 70%. A 6 March reseller’s pitch for a VanHelsing kit claims 80% and a $5,000 deposit; the kit itself was advertised for 700 Telegram Stars.
This is a resale offer, not recruitment by the original group. Nova and Gunra exclude CIS targets in their ads; Firestorm advertises a built-in CIS check.
Vect, KRYBIT and Firestorm publish programme ads without a split. Two partner notices instead concern pressure on victims. The retained insider description does not say who would receive any percentage, so it is excluded from the share comparison.
Negotiation Became a Product
The ads describe different ways to staff the talks. Gunra says its own staff can negotiate, while The Gentlemen assign control to the affiliate. These examples distinguish the person conducting a chat from the provider of the locker and infrastructure.
The edited KRYBIT description says lawyers and journalists may be used to influence negotiations. The BLACKNET-00 description lists triple extortion, a public auction and ransom-discount management. Those advertised functions concern pressure and administration; the catalogue does not prove that the services were delivered.
- The product
- A turnkey RaaS platform with victim chat and a branded leak site. The ad says the buyer keeps all profit.
- The price
- $5,000, one time.
- Also on offer
- A dedicated negotiation team, advertised in the crew’s own recruitment post on 1 July.
- Advertised portal
- $100 setup and $30 a month; a separate $200 upfront stub charge.
- Advertised split
- 90% to the affiliate; no transaction or successful deployment was verified.
The pressure rules are published too. A notice first seen on 1 February, from the Mimic crew, told its partners how to force the talks. A target silent for two weeks gets an undated public entry on the leak site.
An older RaaS thread was first seen on 14 January and updated on 17 January. It announced a legal team that files paperwork against victims who stop talking or refuse to pay.
The catalogue records both as forum items. Its dates are first-seen dates, not original-publication dates. These are stated pressure tactics, not a guarantee of how a crew will behave.
- The notice says
- After two weeks without a response, partners should make an undated public entry to pressure the target.
- What this establishes
- A stated publication policy; the catalogue’s first-seen date does not establish when the original notice was written.
Two demand examples discussed in the catalogue are unverified: a $5,500 figure quoted from a 2022 case and the VanHelsing reseller’s claim of up to $500,000. They are examples, not an exhaustive inventory or current negotiated amounts.
Where Crews Recruit
Vect advertised its second version on 14 February. On 25 March it announced a partnership with a forum in the BreachForums mould, under which every member was offered an affiliate key. A post of 16 April claimed the keys were being sent to all registered users. The Gentlemen followed on 15 and 16 May with their own ad and a partnership announcement.
A Russian-language chat reported on 13 June that one forum had started to admit ransomware ads for a 0.5 BTC deposit.
On 28 January the FBI seized RAMP, the forum that ransomware crews had used openly since 2021 after Exploit and XSS banned such promotion, according to BleepingComputer.
The retained recruitment items appear on forums and Telegram. These venues show where this selection is visible. They do not establish movement from the seized forum, because the selected records are not a before-and-after sample of that venue.
Dated Tools and Platform Offers
Amounts here are as the ads give them; none names a currency. A builder with a graphical interface, decryptor and web panel was advertised at $50 on 29 April. An industrial builder was offered at $890 on 23 April, and an EDR killer at $550 on 18 August.
The edited catalogue records a $5,000 one-time CRPX0 platform offer on 23 July, with affiliate management, a branded leak site and a negotiation portal. The buyer-keeping-profit clause belongs to this platform sale, separately from the 1 July affiliate commission.
Selected BLACKNET-00 offers appeared in the same Telegram channel and are grouped as Seller A; common seller identity is an inference. The catalogue records a one-buyer builder-and-injector package at $400 on 20 June, an open-sale $20 offer the next day and a $1,000 source-code offer on 1 August. Package and access terms change, so the sequence is not a market price curve.
Six catalogue items are classified as free-builder sharing, including descriptions of Petya-style, Chaos and Arsium code. Some items combine multiple posts or threads. The descriptions do not verify free access, delivery or safe code. This is a catalogue distribution category, not a comparable paid product tier.
The initial 60-item catalogue contains one EDR-killer price and no broader crypter market tied to ransomware; a separate five-offer price audit is covered in the EDR killer article. The catalogue is not a complete tooling-market inventory.
Who Wants In
We retained six catalogue items about seeking or supplying access to crews, including a reply under Vect’s recruitment thread. On 6 June, one description records access without malware skills and a request for a ready-to-deploy locker. This is a proposed division of work, not a verified intrusion or deal.
A different catalogue item, first seen on 3 February and repeated on 2 April, offers to monetise corporate access for a profit share. The two descriptions meet at the same dependency: a locker provider needs access, while an access holder may need a provider. We have not linked either item to a later claim.
The Claims Next to the Ads
Now the leak sites. Between January and July, Blackhole counted between 761 and 963 claims a month, a mean of 834.1. August brought 1,321, the busiest month in the observed period, and 1,177 of those claims were seen by two or more relay bots.
September fell to 954 and October reached 1,089 by the 27th. NCC Group’s count also peaked in August, at 1,073 attacks, its 2026 high; its September report puts September at 821. The two series use different collection methods and have not been reconciled.
Public trackers carry these claims too; nothing in the count itself is exclusive to us.
Recruitment ads were first seen in seven of the ten months, with none in March, August or September. August did contain reposts and sales posts: the gap is in first sightings of programme ads. It establishes no cause for the claim peak.
The group stories show that the order is mixed. Vect posted 19 of its 25 claims in February, the month of its second-version ad. Nova’s relaunch ad came on 22 April, after 14 claims from January to March and 8 in April. Its claims peaked in the three months after, at 23, 25 and 21, with none in our dataset after July.
CRPX0 advertised on 1 July and posted 26 distinct claims that month and 23 in August, then none. KRYBIT claimed first, 23 in April, and advertised on 17 May. Gunra peaked at 15 claims in March and advertised in April.
The Gentlemen were already at 90 claims in May, the month of their ad, and reached 159 in August.
The field itself widened. Active groups rose from 58 in January to 92 in August and stood at 85 in October. Qilin (1,146 claims) and The Gentlemen (1,012) together made up 23.4% of everything.
The 33 groups that posted in eight or more months hold 64.7% of the claims. At the other end, 50 groups appear in a single month. n0n, a group first seen in September, posted 145 of October’s 1,089 claims.
October is partial, so this is not a full-month comparison.
January’s Leaders Represented Less of September
The ten labels with the most January claims accounted for 527 of 784 recorded claims (67.2%). Keeping that list fixed, their September share was 278 of 954 (29.1%). Each month’s total recorded canonical group–victim pairs supplies the denominator.
September’s own top ten held 439 claims (46.0%). Choosing leaders after seeing that month’s results describes concentration with hindsight. It cannot show what a forward monitor would have captured.
This comparison separates January’s leaders from the persistent core above, which is selected using the whole study. A fixed January list represents less of September’s recorded output. Familiar names can remain prominent while a name-based summary becomes narrower. The K5 and K20 checks let readers inspect how list size affects this comparison.
Canonical labels do not identify people. Renaming and collection changes could affect the pattern. The result measures neither alert coverage nor detection effectiveness.
Scroll horizontally to inspect the chart on a small screen.
| Month | Cohort Claims | All Recorded Claims | Share |
|---|---|---|---|
| January | 527 | 784 | 67.2% |
| September | 278 | 954 | 29.1% |
Monthly CSV · K5/K10/K20 CSV · Cohort Method and Reproduction
When Talks Fail
The catalogue describes alleged failed-talk listings with several routes: unpriced publication, reposting and an offer for sale. Some catalogue items combine multiple records, so we do not treat the item count as independent failed negotiations. The data-circulation investigation compares those routes and their limits.
One database went up for sale at $10,000 on 16 March. One was given away on 27 March. Two releases attributed to Everest appeared on 6 July after a countdown had expired.
This is leak-site material getting a second life.
The circulation article compares unpriced release, reposting and sale descriptions. It does not join those routes into a verified victim journey or use a publication interval as a response deadline.
The tail of one crew is visible too. CRPX0 offered a platform and an EDR killer in July and August, while its claims faded: 49 distinct claims in two months, none after August. Whether that was an exit or a sale of the brand, the data does not say.
Relay Speed Is a Distribution Measure
In the collected series, 7,862 claims, or 85.4%, appear through at least two relays. Among those claims, the median span between the earliest and latest first relay appearances is about 1.3 hours. This measures how a claim travels through the collection, not when an intrusion began or when a defender first could act.
A vulnerability advisory and a leak-site claim can concern different events. Without an event-level join, subtracting their dates would create a misleading warning interval. Defenders should investigate vendor warnings and their own telemetry without waiting for a leak-site name.
What These Sources Can Answer
The catalogue can describe a selected offer’s roles, fees and conditions. The claim series can show concentration and first-observation timing. Neither establishes a verified sale, the identity behind a channel or the reason a group became quiet. The useful result comes from keeping those questions separate while comparing the responsibilities advertised.
What the Price List Says
The ads describe a division of labour. Access, the locker, negotiation and publication can sit with different parties. A provider can sell the portal while the affiliate conducts the talk. Reading those terms beside the claim series separates the programme being offered from the output attributed to a group name.
If You See This, Do This
These steps follow the cases and the ads above. For the full monitoring process, see our guide to responding to leak site listings.
- Your name, domain or brand is in a claimTreat it as day 0. Check edge devices, file transfer, VPN and EDR within hours, investigate possible data theft, preserve evidence, involve incident response and legal, and pre-write a holding statement.
- A supplier or software vendor is claimedAsk for written confirmation, rotate shared credentials and API keys, and review inbound connections.
- A KEV-listed or vendor-warned flaw is in software you runApply the vendor remediation and hunt for compromise. Do not wait for a claim to investigate an actively exploited flaw in software you run.
- A group claims your sector or countryRaise the watch level and check exposed VPN and edge devices.
- A deadline or auction note appearsPlan for publication. One Mimic notice calls for an undated public entry after two weeks of silence; this is a stated policy, not a guaranteed schedule.
- A ransom note points to a negotiation portal or victim chatA service provider may be on the other side, not the crew itself. Keep your own channel and your own counsel, and do not assume the people behind the portal wrote the attack.
- A claim looks oddIf a victim shows up under a new group, or a group vanishes, verify before you act. Claims are not confirmed breaches.
- Combine monitoring with your own logs14.6% of claims reached only one relay. Relay repetition is not independent confirmation. Check alerts against other sources and your own evidence.
Evidence and Scope
This article uses the edited 60-item ransomware catalogue and the collected relay series for 1 January–27 October 2026. Catalogue dates are first-seen dates.
The selection is not a market census; programme descriptions, advertised terms and claims are different evidence units. The catalogue is an attributed account, not a fresh authentication of every original. October is partial and 22–28 July is sampled.
A claim is one canonical group–victim pair. The 9,203-claim series excludes 190 0APT claims and removes 171 spelling-variant duplicates. A repeated relay post is not independent confirmation. Asking terms do not establish payments, delivery or tested effectiveness.
AI-Assisted Preparation
Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.
Brandefense analysts reviewed and approved the findings.
