One offer in our infostealer catalogue lets a licensee sell access to a compromised machine, together with its logs, to a third buyer. That buyer is said to need no subscription. A different panel offer advertises worker accounts but threatens a ban without refund for resale.
The resale restriction does not specify the exact asset covered, so these are not proven opposite rules for the same activity. They do show why permission matters when examining an advertised partnership.
Sharing work, passing access and owning infrastructure are different propositions. We compare four selected, edited offers across three chapters of Cybercrime Report 2026 to examine where each arrangement places work, permission and dependence. These are advertised terms, not verified transactions or a map of a real criminal organization.
Four Ways to Divide the Work
01A Hosted Service Keeps Part of the Operation With the Provider
A phishing dashboard offer includes a template library and says its browsers run on the provider's servers. Customers are told they need not manage those servers. Messaging carries a separate charge per segment, without a stated segment price.
The advertised benefit is relief from running part of the infrastructure. The customer would still depend on that hosted component, while message delivery has a separate billing boundary. A subscription therefore describes access to a package, rather than ownership of every resource or inclusion of every cost.
02Worker Roles Delegate Tasks Inside a Product
The panel offer describes a Team tier with sub-accounts, named worker roles, log access and separate statistics. Its organizational promise is to divide work within the product. Those roles describe product design; they do not establish how many people used it or whether an actual team existed.
This is a different relationship from outsourcing hosting. The panel allocates functions to accounts inside a service, while the hosted dashboard offer assigns browser operation to the provider. Both can distribute work without advertising ownership of the underlying infrastructure.
03An Onward Permission Extends Access Beyond the Subscriber
The premium sharing feature describes another boundary: a subscriber may sell machine access and logs to someone who needs no subscription. The selling point is an onward permission, beyond the subscriber's own use.
Worker roles alone would not establish that permission. Neither would a subscription alone establish a right to transfer access. Here, that right is an explicit feature in the offer. The transfer mechanism and the buyer's ability to use the access remain untested.
04A Buy-Side Request Defines What Someone Else Should Supply
A stolen-credentials rate sheet requests files containing account names, passwords, and cookies or a two-factor secret. It states batch-related rates and a submission deadline.
This arrangement starts with demand for an input. It does not offer to host a service or assign product roles. The requester defines the contents it wants someone else to supply; the record does not establish the supplier, the material's origin, delivery or payment. For an analyst, classifying the post as a supply request preserves a distinction that would be lost if every mention of accounts became a newly observed compromise.
These are four relationships drawn from four records, not four stages of one attack. Their common question is who supplies what. Their difference is whether cooperation concerns running a service, assigning work, passing a permission or obtaining an input.
What the Offers Reveal About Decision-Making
The choices expressed in the offers concern what to run directly, what to obtain from someone else and what to permit another recipient to do. The dashboard advertises infrastructure relief.
The panel advertises task allocation. The sharing feature advertises a transfer right. The rate sheet states input requirements.
That is the commercial logic visible in the text. It does not reveal an individual's personality or establish that different roles belong to different people. It also shows why “hacker” is too broad a label here. A service provider, a panel user and a requester of account files occupy different positions in these advertised arrangements.
Support Promises and Sanctions Allocate Different Responsibilities
The dashboard advertises a trial. The panel describes a refund for the remaining period if a reported issue stays unresolved, and an extension for a confirmed seller-side bug. It also mentions a purchase intermediary. Alongside those promises are bans without refund for resale, public scanning of builds and attempts to remove a regional exclusion.
- A trialDashboard
- A refund for the remaining period if a reported issue stays unresolvedPanel
- An extension for a confirmed seller-side bugPanel
- A purchase intermediaryPanel
- ResalePanel
- Public scanning of buildsPanel
- Attempts to remove a regional exclusionPanel
The panel's terms therefore assign different consequences to service problems and prohibited use. A seller-side bug is presented as grounds for a remedy; a user's breach of the stated restrictions is presented as grounds for losing service without a refund. This is an advertised allocation of responsibility, not evidence of fair adjudication or fulfilled remedies.
That allocation makes dependence more visible. Worker accounts may distribute tasks, but their advertised use still sits within rules and sanctions specified in the offer. The premium sharing feature from the other product shows a permission explicitly being marketed; it cannot be imported into the panel's terms. Cooperation has to be read at the level of the particular arrangement.
What Changes When the Roles Are Kept Separate
For threat intelligence, a hosted tool offer does not identify whoever might use it in an operation. A worker-account feature does not identify a criminal team. An explicit transfer clause describes an advertised route to another recipient, while a buy-side sheet describes demand. Collapsing those observations would turn a product description into unsupported attribution or an unconfirmed incident.
Our existing ransomware negotiation analysis makes a related distinction: a portal and responsibility for the talks are separate propositions. A communication channel alone does not establish the authority of its user. The consequence is practical: evidence of service provision, product access or a message should not substitute for evidence about who controls the material or the decision under investigation.
For workplace awareness, the account-data request also gives context to the reminder “Your Account Is More Than a Password”: the advertiser asks for additional account material. The employee materials translate that finding into a reporting reminder; the catalogue does not measure the reminder's effectiveness.
Across these selected records, collaboration appears as specific allocations of work, rights and consequences. These are distinct positions in the advertised business. One party may supply the service, another receive limited functions, and another be an intended buyer of access or supplier of data. The text lets us distinguish those arrangements without pretending to reconstruct the people behind them.
Scope and Sources
This qualitative comparison uses four edited public records: FR-O007, IS-O005, IS-O007 and SC-O011. They were selected for the different responsibilities their terms describe, not randomly sampled. One record includes a later update. The comparison is not a census, a prevalence estimate or a reconstructed cooperation network.
No new contact, purchase, account access or capability test was performed. Advertised functions, delivery, sanctions and remedies were not independently verified. Public examples remain edited; source handles and criminal contact links are not reproduced.
