{ "version": "1.0", "built_date": "2026-10-30", "title": "Exploits, Malware Tooling and AI-Assisted Crime", "creator": "Brandefense Research Team", "source": "Brandefense Blackhole", "chapter_key": "exploit-trade", "period": { "start": "2026-01-01", "end": "2026-10-27", "timezone": "as_recorded", "query_window_timezone": "UTC", "partial_month": "2026-10", "label": "1 January–27 October 2026", "date_field": "post.created_at" }, "summary": { "collected_post_ids_retrieved": { "value": 66057, "unit": "distinct retrieved post IDs", "definition": "Distinct post IDs returned by any search of the chapter sets (exploit, tooling, AI)." }, "collected_post_ids_retained": { "value": 22835, "unit": "distinct retained post IDs", "definition": "Retrieved IDs with no cleaning drop reason in at least one set; not verified offers." }, "retained_platform_mix": { "value": { "telegram": 18135, "paste": 1664, "forum": 1598, "discord": 1438 }, "unit": "distinct retained post IDs", "definition": "Platform of retained posts; forums are over-represented relative to the corpus because of the sets searched." }, "by_family": { "value": { "exploit": { "retrieved": 22614, "retained": 4855 }, "tooling": { "retrieved": 30682, "retained": 16242 }, "ai": { "retrieved": 13559, "retained": 2076 } }, "unit": "distinct post IDs", "sum_of_family_retrieved": 66855, "union_retrieved": 66057, "definition": "Retrieved IDs have family membership. Retained counts are globally retained IDs with that family membership (kept in any family). For exploit membership this is 4,855; 4,814 are kept in at least one exploit set. The 41-ID difference is retained only outside exploit sets. Families overlap and must not be added." }, "blackhole_calls_new_pull": { "attempts": 2490, "failures": 3, "definition": "HTTP attempts logged in calls.csv for the chapter-specific pull; foundation sets reuse the earlier pull." }, "retrieval_windows": { "rows": 2160, "sets": 45, "modes": { "full": 1032, "sample": 542, "count": 586 }, "definition": "Rows in retrieval-windows.csv." }, "exploit_pool": { "value": { "retrieved_post_ids_in_the_17_exploit_sets": 22614, "union_of_candidates_all_chapter_families_not_the_exploit_funnel": 66057, "retained_in_at_least_one_exploit_set": 4814, "retained_with_commercial_or_request_signal": 1363, "after_near_duplicate_removal_first_200_normalised_chars": 1150, "duplicate_copies_removed": 213, "classified_stratified_random_sample": 700, "sample_fraction_of_deduplicated_pool_pct": 60.9, "sampling": { "seed": 545, "strata_month_x_primary_set": 133, "allocation": "proportional (largest remainder)", "primary_set_rule": "for posts in several sets: the set with the smallest pool count" }, "cve_named_census_supplement_outside_sample": 33, "funnel_rule": "Funnel counts only the 17 exploit sets. Signal rule (step1_pool.py): retained in >=1 exploit set AND (sale_terms is True OR has_usd_price OR regex \\b(wts|wtb|selling|sell|sale|buy|buying|price|prices|escrow|private|priv8|exclusive|slots?|for sale)\\b | продам | куплю | продаю | 出售 | 收 on the text, case-insensitive). Near-duplicates: normalised first 200 characters, earliest kept. Reproduce with private/step1_pool.py." }, "unit": "distinct retained post IDs", "definition": "Exploit-set funnel: IDs retained in at least one of the 17 exploit sets. This differs from global retention with exploit membership." }, "exploit_offers_requests": { "count": 221, "denominator": 700, "share_pct": 31.6, "wilson95_pct": [ 28.2, 35.1 ], "definition": "Direct offers, service offers and buyer requests among 700 classified sampled posts; 11 are commercial but not exploit-related.", "breakdown": { "direct_offer": 183, "service_offer": 10, "buyer_request": 28 } }, "exploit_cve_named": { "count": 2, "denominator": 221, "share_pct": 0.9, "definition": "Offers or requests whose text names a CVE; sellers may omit a CVE on purpose. All 33 CVE-named pool posts outside the sample were read and none was an offer." }, "exploit_funnel": { "retrieved_in_17_exploit_sets": 22614, "retained": 4814, "with_commercial_or_request_signal": 1363, "after_near_duplicate_removal": 1150, "classified_sample": 700, "union_all_chapter_families": 66057, "definition": "Exploit funnel in distinct post IDs. The 66,057 union across all chapter families is not the exploit funnel.", "retention_definition": "Kept in at least one exploit set; not global retention with exploit membership." }, "exploit_zero_day_label_use": { "seller_posts": 182, "with_label": 93, "claim_one_unnamed_exploit": 37, "composition_by_object": { "exploit_unnamed_0day_claim": 37, "other": 25, "mass_exploitation_tool": 12, "other:unlicensed_or_shared_tool_bundle": 8, "other:exploit_feed_subscription": 5, "exploit_kit_or_builder": 3, "course": 1, "checker_scanner_only": 1, "public_poc_repackaged": 1 }, "share_pct": 51.1, "wilson95_pct": [ 43.9, 58.3 ], "named_cve": 0, "priced": 43, "definition": "Exploit seller posts (182 = the 193 direct and service seller posts minus 11 off-topic commercial) whose text uses 0-day or zero-day in any form, including menu lines and feature words; only 37 were coded as unnamed-exploit claims (a broad code that also includes research services, multi-exploit lists and chains, so it is not one flaw each). A 0-day may have no public CVE yet, so a missing CVE alone does not show whether a claim is real or false." }, "seller_bases": { "label_statistics": 182, "price_and_object_statistics": 193, "off_topic_commercial": 11, "definition": "Seller-post bases: 182 for the 0-day label statistics, 193 for price, object and tools-versus-exploit-claim statistics; buyer requests (28) are in neither." }, "tooling_non_bundle_offers": { "n": 121, "fud_claims": 33, "escrow": 19, "support": 16, "updates": 12, "rebuild": 5, "hosting": 3, "refund": 1, "evasion_products_fud": 18, "evasion_products": 29, "definition": "Strict direct and service offers excluding one reposted Turkish bundle advert (48 posts, almost no seller terms): the base for seller-term shares in the tooling article." }, "exploit_priced_seller_posts": { "with_stated_amount": 70, "seller_posts": 193, "share_pct": 36.3, "definition": "Seller posts that state at least one amount; denominations are mostly unstated." }, "exploit_sample_composition": { "telegram": 438, "forum": 229, "of": 700, "definition": "Platform mix of the 700 classified exploit posts; forums are under 1% of the Blackhole corpus and over-represented by the sets searched." }, "exploit_tools_and_shells_vs_single_exploit_claims": { "tools_and_shells": 56, "single_exploit_claims": 47, "seller_posts": 193, "definition": "Seller posts only: mass-exploitation tools plus web shells or access results, against unnamed 0-day claims plus CVE-named exploits plus repackaged public PoCs (derived sums)." }, "tooling_strict_on_topic": { "count": 182, "denominator": 700, "share": 0.26, "wilson95": [ 0.229, 0.294 ], "definition": "Direct offers, service offers or buyer requests of in-scope tool types among 700 classified sampled posts." }, "tooling_strict_offers": { "count": 169, "definition": "Direct and service strict offers; the base for seller-term shares." }, "tooling_fud_claims": { "count": 33, "denominator": 169, "definition": "Strict offers whose text makes a FUD or undetectable claim of any kind; one states a window in days." }, "ai_named_tool_texts": { "distinct_texts": 607, "post_ids": 672, "definition": "Pool A: retained posts in seven named-tool searches, duplicates on the first 200 normalised characters collapsed." }, "ai_offer_type_texts": { "count": 168, "denominator": 607, "share": 0.277, "wilson95": [ 0.243, 0.314 ], "definition": "Access resale, subscription, prompt or jailbreak pack, or name reused for another service, among pool A distinct texts." }, "catalogue_records": { "total": 99, "by_domain": { "exploit": 35, "tooling": 34, "ai": 30 }, "definition": "Purposive, diversity-seeking evidence records; not a sample, not prevalence, not sellers." }, "ai_hosted_access_texts": { "count": 141, "no_backend_stated": 122, "definition": "Pool A access-resale and subscription texts minus source-code, file and build-service sales; one reader, backend field kappa 0.24, indicative." }, "ai_priced_offer_texts": { "pool_A": 78, "pool_B": 8, "pool_A_plus_B": 86, "definition": "Offer-type texts that state at least one price, hand-checked; labels are mutually exclusive. No conversion." }, "tooling_turkish_bundle": { "sampled_posts": 48, "strict_on_topic": 182, "strict_share_without_bundle": 0.206, "definition": "One reposted Turkish multi-service advert in the strict on-topic sample; the strict share without it is shown." }, "headline_metric": { "value": "37 of 93", "definition": "93 of 182 exploit seller posts use the word 0-day; 37 were coded as unnamed-exploit claims; none names a CVE." } }, "domains": { "exploit": { "label": "Exploits", "classification": [ { "domain": "exploit", "dimension": "intent", "code": "noise_or_spam", "count": 313, "denominator": 700, "share": 0.4471, "note": "classified sample of 700 post IDs" }, { "domain": "exploit", "dimension": "intent", "code": "direct_offer", "count": 183, "denominator": 700, "share": 0.2614, "note": "classified sample of 700 post IDs" }, { "domain": "exploit", "dimension": "intent", "code": "relay_or_news", "count": 95, "denominator": 700, "share": 0.1357, "note": "classified sample of 700 post IDs" }, { "domain": "exploit", "dimension": "intent", "code": "unclear", "count": 30, "denominator": 700, "share": 0.0429, "note": "classified sample of 700 post IDs" }, { "domain": "exploit", "dimension": "intent", "code": "buyer_request", "count": 28, "denominator": 700, "share": 0.04, "note": "classified sample of 700 post IDs" }, { "domain": "exploit", "dimension": "intent", "code": "tutorial_or_course", "count": 27, "denominator": 700, "share": 0.0386, "note": "classified sample of 700 post IDs" }, { "domain": "exploit", "dimension": "intent", "code": "poc_share_free", "count": 14, "denominator": 700, "share": 0.02, "note": "classified sample of 700 post IDs" }, { "domain": "exploit", "dimension": "intent", "code": "service_offer", "count": 10, "denominator": 700, "share": 0.0143, "note": "classified sample of 700 post IDs" }, { "domain": "exploit", "dimension": "offered_object", "code": "exploit_unnamed_0day_claim", "count": 57, "denominator": 221, "share": 0.2579, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "offered_object", "code": "other", "count": 44, "denominator": 221, "share": 0.1991, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "offered_object", "code": "mass_exploitation_tool", "count": 36, "denominator": 221, "share": 0.1629, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "offered_object", "code": "access_or_shells_result", "count": 31, "denominator": 221, "share": 0.1403, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "offered_object", "code": "other:exploit_feed_subscription", "count": 12, "denominator": 221, "share": 0.0543, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "offered_object", "code": "other:off_topic_commercial", "count": 11, "denominator": 221, "share": 0.0498, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "offered_object", "code": "other:unlicensed_or_shared_tool_bundle", "count": 8, "denominator": 221, "share": 0.0362, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "offered_object", "code": "exploit_kit_or_builder", "count": 6, "denominator": 221, "share": 0.0271, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "offered_object", "code": "checker_scanner_only", "count": 4, "denominator": 221, "share": 0.0181, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "offered_object", "code": "course", "count": 4, "denominator": 221, "share": 0.0181, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "offered_object", "code": "public_poc_repackaged", "count": 3, "denominator": 221, "share": 0.0136, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "offered_object", "code": "other:named_product_exploit_no_cve", "count": 3, "denominator": 221, "share": 0.0136, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "offered_object", "code": "private_exploit_named_cve", "count": 2, "denominator": 221, "share": 0.009, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "target_class", "code": "web_app_cms_plugin", "count": 95, "denominator": 221, "share": 0.4299, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "target_class", "code": "unspecified", "count": 71, "denominator": 221, "share": 0.3213, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "target_class", "code": "enterprise_app", "count": 21, "denominator": 221, "share": 0.095, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "target_class", "code": "browser_mobile", "count": 16, "denominator": 221, "share": 0.0724, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "target_class", "code": "os_lpe", "count": 11, "denominator": 221, "share": 0.0498, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "target_class", "code": "email_collab_server", "count": 6, "denominator": 221, "share": 0.0271, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "target_class", "code": "iot_router", "count": 1, "denominator": 221, "share": 0.0045, "note": "offers and requests only" }, { "domain": "exploit", "dimension": "cve_status", "code": "no_cve", "count": 219, "denominator": 221, "share": 0.991, "note": "KEV labels use 2026 additions only; descriptive, not early warning" }, { "domain": "exploit", "dimension": "cve_status", "code": "kev_before_post", "count": 1, "denominator": 221, "share": 0.0045, "note": "KEV labels use 2026 additions only; descriptive, not early warning" }, { "domain": "exploit", "dimension": "cve_status", "code": "not_in_2026_kev_file", "count": 1, "denominator": 221, "share": 0.0045, "note": "KEV labels use 2026 additions only; descriptive, not early warning" }, { "domain": "exploit", "dimension": "trust_or_scarcity_term", "code": "slot_or_stock_limit", "count": 21, "denominator": 221, "share": 0.095, "note": "a record can carry several terms; shares do not sum to the 71 records with any term" }, { "domain": "exploit", "dimension": "trust_or_scarcity_term", "code": "demo_or_test", "count": 18, "denominator": 221, "share": 0.0814, "note": "a record can carry several terms; shares do not sum to the 71 records with any term" }, { "domain": "exploit", "dimension": "trust_or_scarcity_term", "code": "middleman", "count": 15, "denominator": 221, "share": 0.0679, "note": "a record can carry several terms; shares do not sum to the 71 records with any term" }, { "domain": "exploit", "dimension": "trust_or_scarcity_term", "code": "forum_or_platform_escrow", "count": 15, "denominator": 221, "share": 0.0679, "note": "a record can carry several terms; shares do not sum to the 71 records with any term" }, { "domain": "exploit", "dimension": "trust_or_scarcity_term", "code": "video_proof", "count": 11, "denominator": 221, "share": 0.0498, "note": "a record can carry several terms; shares do not sum to the 71 records with any term" }, { "domain": "exploit", "dimension": "trust_or_scarcity_term", "code": "exclusivity_single_buyer", "count": 7, "denominator": 221, "share": 0.0317, "note": "a record can carry several terms; shares do not sum to the 71 records with any term" }, { "domain": "exploit", "dimension": "trust_or_scarcity_term", "code": "resale_ban", "count": 2, "denominator": 221, "share": 0.009, "note": "a record can carry several terms; shares do not sum to the 71 records with any term" }, { "domain": "exploit", "dimension": "trust_or_scarcity_term", "code": "pay_after_success", "count": 1, "denominator": 221, "share": 0.0045, "note": "a record can carry several terms; shares do not sum to the 71 records with any term" }, { "domain": "exploit", "dimension": "trust_or_scarcity_term", "code": "no_refund_term", "count": 1, "denominator": 221, "share": 0.0045, "note": "a record can carry several terms; shares do not sum to the 71 records with any term" }, { "domain": "exploit", "dimension": "trust_or_scarcity_term", "code": "guarantee_or_refund_term", "count": 1, "denominator": 221, "share": 0.0045, "note": "a record can carry several terms; shares do not sum to the 71 records with any term" }, { "domain": "exploit", "dimension": "zero_day_label_use_by_object", "code": "exploit_unnamed_0day_claim", "count": 37, "denominator": 93, "share": 0.3978, "note": "the 93 of 182 exploit seller posts that use 0-day or zero-day in any form, by offered object; 0 name a CVE; 43 show a price" }, { "domain": "exploit", "dimension": "zero_day_label_use_by_object", "code": "other", "count": 25, "denominator": 93, "share": 0.2688, "note": "the 93 of 182 exploit seller posts that use 0-day or zero-day in any form, by offered object; 0 name a CVE; 43 show a price" }, { "domain": "exploit", "dimension": "zero_day_label_use_by_object", "code": "mass_exploitation_tool", "count": 12, "denominator": 93, "share": 0.129, "note": "the 93 of 182 exploit seller posts that use 0-day or zero-day in any form, by offered object; 0 name a CVE; 43 show a price" }, { "domain": "exploit", "dimension": "zero_day_label_use_by_object", "code": "other:unlicensed_or_shared_tool_bundle", "count": 8, "denominator": 93, "share": 0.086, "note": "the 93 of 182 exploit seller posts that use 0-day or zero-day in any form, by offered object; 0 name a CVE; 43 show a price" }, { "domain": "exploit", "dimension": "zero_day_label_use_by_object", "code": "other:exploit_feed_subscription", "count": 5, "denominator": 93, "share": 0.0538, "note": "the 93 of 182 exploit seller posts that use 0-day or zero-day in any form, by offered object; 0 name a CVE; 43 show a price" }, { "domain": "exploit", "dimension": "zero_day_label_use_by_object", "code": "exploit_kit_or_builder", "count": 3, "denominator": 93, "share": 0.0323, "note": "the 93 of 182 exploit seller posts that use 0-day or zero-day in any form, by offered object; 0 name a CVE; 43 show a price" }, { "domain": "exploit", "dimension": "zero_day_label_use_by_object", "code": "course", "count": 1, "denominator": 93, "share": 0.0108, "note": "the 93 of 182 exploit seller posts that use 0-day or zero-day in any form, by offered object; 0 name a CVE; 43 show a price" }, { "domain": "exploit", "dimension": "zero_day_label_use_by_object", "code": "checker_scanner_only", "count": 1, "denominator": 93, "share": 0.0108, "note": "the 93 of 182 exploit seller posts that use 0-day or zero-day in any form, by offered object; 0 name a CVE; 43 show a price" }, { "domain": "exploit", "dimension": "zero_day_label_use_by_object", "code": "public_poc_repackaged", "count": 1, "denominator": 93, "share": 0.0108, "note": "the 93 of 182 exploit seller posts that use 0-day or zero-day in any form, by offered object; 0 name a CVE; 43 show a price" }, { "domain": "exploit", "dimension": "zero_day_label_use", "code": "uses_0day_or_zero_day", "count": 93, "denominator": 182, "share": 0.511, "note": "exploit seller posts (direct and service offers, excluding off-topic commercial)" }, { "domain": "exploit", "dimension": "zero_day_label_use", "code": "does_not_use_label", "count": 89, "denominator": 182, "share": 0.489, "note": "exploit seller posts (direct and service offers, excluding off-topic commercial)" } ], "precision": [ { "domain": "exploit", "set": "ALL_CLASSIFIED", "on_topic": 221, "n": 700, "share": 0.3157, "wilson_low": 0.282, "wilson_high": 0.351, "basis": "overall; on-topic = direct offer, service offer or buyer request" }, { "domain": "exploit", "set": "c_exploit", "on_topic": 39, "n": 84, "share": 0.4643, "wilson_low": 0.362, "wilson_high": 0.57, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "c_exploit_vuln", "on_topic": 5, "n": 20, "share": 0.25, "wilson_low": 0.112, "wilson_high": 0.469, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "c_vulnerability", "on_topic": 0, "n": 17, "share": 0.0, "wilson_low": 0.0, "wilson_high": 0.184, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "c_zeroday", "on_topic": 36, "n": 67, "share": 0.5373, "wilson_low": 0.419, "wilson_high": 0.651, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "k_0day", "on_topic": 51, "n": 222, "share": 0.2297, "wilson_low": 0.179, "wilson_high": 0.289, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "k_exploit", "on_topic": 23, "n": 47, "share": 0.4894, "wilson_low": 0.353, "wilson_high": 0.628, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "k_zero_day", "on_topic": 55, "n": 210, "share": 0.2619, "wilson_low": 0.207, "wilson_high": 0.325, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "x_0day_exploit", "on_topic": 9, "n": 15, "share": 0.6, "wilson_low": 0.357, "wilson_high": 0.802, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "x_cve_2025", "on_topic": 0, "n": 4, "share": 0.0, "wilson_low": 0.0, "wilson_high": 0.49, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "x_cve_2026", "on_topic": 0, "n": 2, "share": 0.0, "wilson_low": 0.0, "wilson_high": 0.658, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "x_exploit_for_sale", "on_topic": 5, "n": 5, "share": 1.0, "wilson_low": 0.566, "wilson_high": 1.0, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "x_exploit_kit", "on_topic": 6, "n": 22, "share": 0.2727, "wilson_low": 0.132, "wilson_high": 0.482, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "x_lpe", "on_topic": 3, "n": 17, "share": 0.1765, "wilson_low": 0.062, "wilson_high": 0.41, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "x_poc", "on_topic": 5, "n": 23, "share": 0.2174, "wilson_low": 0.097, "wilson_high": 0.419, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "x_private_exploit", "on_topic": 28, "n": 35, "share": 0.8, "wilson_low": 0.641, "wilson_high": 0.9, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "x_rce_exploit", "on_topic": 6, "n": 11, "share": 0.5455, "wilson_low": 0.28, "wilson_high": 0.787, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "x_selling_exploit", "on_topic": 7, "n": 8, "share": 0.875, "wilson_low": 0.529, "wilson_high": 0.978, "basis": "source-set membership (sets overlap)" }, { "domain": "exploit", "set": "class_sets", "on_topic": 80, "n": 186, "share": 0.4301, "wilson_low": 0.361, "wilson_high": 0.502, "basis": "set family (overlapping memberships)" }, { "domain": "exploit", "set": "keyword_sets", "on_topic": 121, "n": 460, "share": 0.263, "wilson_low": 0.225, "wilson_high": 0.305, "basis": "set family (overlapping memberships)" }, { "domain": "exploit", "set": "new_x_sets", "on_topic": 67, "n": 140, "share": 0.4786, "wilson_low": 0.398, "wilson_high": 0.561, "basis": "set family (overlapping memberships)" } ], "agreement": [ { "domain": "exploit", "measure": "intent", "n": 120, "agree_raw": 0.9167, "kappa": 0.9014, "kappa_ci_low": 0.838, "kappa_ci_high": 0.951, "design_weighted_kappa": 0.9196, "note": "" }, { "domain": "exploit", "measure": "binary_offer_request", "n": 120, "agree_raw": 0.9667, "kappa": 0.9331, "kappa_ci_low": 0.862, "kappa_ci_high": 0.983, "design_weighted_kappa": 0.9326, "note": "" }, { "domain": "exploit", "measure": "binary_offer_request_excluding_offtopic_commercial", "n": 120, "agree_raw": 0.9333, "kappa": 0.8649, "kappa_ci_low": 0.766, "kappa_ci_high": 0.949, "design_weighted_kappa": 0.8777, "note": "" }, { "domain": "exploit", "measure": "object_both_offers", "n": 54, "agree_raw": 0.8333, "kappa": 0.7769, "kappa_ci_low": 0.633, "kappa_ci_high": 0.898, "design_weighted_kappa": "", "note": "" }, { "domain": "exploit", "measure": "cve_named_all", "n": 120, "agree_raw": 0.9833, "kappa": 0.9074, "kappa_ci_low": 0.741, "kappa_ci_high": 1.0, "design_weighted_kappa": "", "note": "" }, { "domain": "exploit", "measure": "cve_named_both_offers", "n": 54, "agree_raw": 0.9815, "kappa": 0.0, "kappa_ci_low": 0.0, "kappa_ci_high": 0.0, "design_weighted_kappa": "", "note": "near-constant variable; kappa not meaningful, read raw agreement" }, { "domain": "exploit", "measure": "price_present_all", "n": 120, "agree_raw": 0.9667, "kappa": 0.8476, "kappa_ci_low": 0.673, "kappa_ci_high": 0.968, "design_weighted_kappa": "", "note": "" }, { "domain": "exploit", "measure": "price_present_both_offers", "n": 54, "agree_raw": 0.9259, "kappa": 0.8154, "kappa_ci_low": 0.596, "kappa_ci_high": 0.958, "design_weighted_kappa": "", "note": "" } ] }, "tooling": { "label": "Malware tooling", "classification": [ { "domain": "tooling", "dimension": "intent", "code": "noise_or_spam", "count": 317, "denominator": 700, "share": 0.4529, "note": "classified sample of 700 post IDs" }, { "domain": "tooling", "dimension": "intent", "code": "direct_offer", "count": 203, "denominator": 700, "share": 0.29, "note": "classified sample of 700 post IDs" }, { "domain": "tooling", "dimension": "intent", "code": "service_offer", "count": 66, "denominator": 700, "share": 0.0943, "note": "classified sample of 700 post IDs" }, { "domain": "tooling", "dimension": "intent", "code": "free_share_or_crack", "count": 43, "denominator": 700, "share": 0.0614, "note": "classified sample of 700 post IDs" }, { "domain": "tooling", "dimension": "intent", "code": "buyer_request", "count": 41, "denominator": 700, "share": 0.0586, "note": "classified sample of 700 post IDs" }, { "domain": "tooling", "dimension": "intent", "code": "relay_or_news", "count": 19, "denominator": 700, "share": 0.0271, "note": "classified sample of 700 post IDs" }, { "domain": "tooling", "dimension": "intent", "code": "tutorial", "count": 8, "denominator": 700, "share": 0.0114, "note": "classified sample of 700 post IDs" }, { "domain": "tooling", "dimension": "intent", "code": "unclear", "count": 3, "denominator": 700, "share": 0.0043, "note": "classified sample of 700 post IDs" }, { "domain": "tooling", "dimension": "tool_type_all_classified", "code": "not_tooling", "count": 359, "denominator": 700, "share": 0.5129, "note": "all 700 classified posts" }, { "domain": "tooling", "dimension": "tool_type_all_classified", "code": "bundle_multi", "count": 95, "denominator": 700, "share": 0.1357, "note": "all 700 classified posts" }, { "domain": "tooling", "dimension": "tool_type_all_classified", "code": "other_not_malware_tooling", "count": 68, "denominator": 700, "share": 0.0971, "note": "all 700 classified posts" }, { "domain": "tooling", "dimension": "tool_type_all_classified", "code": "rat_hvnc", "count": 66, "denominator": 700, "share": 0.0943, "note": "all 700 classified posts" }, { "domain": "tooling", "dimension": "tool_type_all_classified", "code": "crypter", "count": 30, "denominator": 700, "share": 0.0429, "note": "all 700 classified posts" }, { "domain": "tooling", "dimension": "tool_type_all_classified", "code": "spam_phishing_tool", "count": 29, "denominator": 700, "share": 0.0414, "note": "all 700 classified posts" }, { "domain": "tooling", "dimension": "tool_type_all_classified", "code": "stealer", "count": 13, "denominator": 700, "share": 0.0186, "note": "all 700 classified posts" }, { "domain": "tooling", "dimension": "tool_type_all_classified", "code": "c2_or_botnet_panel", "count": 12, "denominator": 700, "share": 0.0171, "note": "all 700 classified posts" }, { "domain": "tooling", "dimension": "tool_type_all_classified", "code": "loader_dropper", "count": 9, "denominator": 700, "share": 0.0129, "note": "all 700 classified posts" }, { "domain": "tooling", "dimension": "tool_type_all_classified", "code": "av_edr_bypass_service", "count": 8, "denominator": 700, "share": 0.0114, "note": "all 700 classified posts" }, { "domain": "tooling", "dimension": "tool_type_all_classified", "code": "obfuscator_packer", "count": 6, "denominator": 700, "share": 0.0086, "note": "all 700 classified posts" }, { "domain": "tooling", "dimension": "tool_type_all_classified", "code": "ransomware_builder_or_edr_killer", "count": 3, "denominator": 700, "share": 0.0043, "note": "all 700 classified posts" }, { "domain": "tooling", "dimension": "tool_type_all_classified", "code": "stresser", "count": 2, "denominator": 700, "share": 0.0029, "note": "all 700 classified posts" }, { "domain": "tooling", "dimension": "tool_type_offers_and_requests", "code": "bundle_multi", "count": 94, "denominator": 310, "share": 0.3032, "note": "direct, service and buyer-request posts only" }, { "domain": "tooling", "dimension": "tool_type_offers_and_requests", "code": "other_not_malware_tooling", "count": 47, "denominator": 310, "share": 0.1516, "note": "direct, service and buyer-request posts only" }, { "domain": "tooling", "dimension": "tool_type_offers_and_requests", "code": "rat_hvnc", "count": 40, "denominator": 310, "share": 0.129, "note": "direct, service and buyer-request posts only" }, { "domain": "tooling", "dimension": "tool_type_offers_and_requests", "code": "not_tooling", "count": 40, "denominator": 310, "share": 0.129, "note": "direct, service and buyer-request posts only" }, { "domain": "tooling", "dimension": "tool_type_offers_and_requests", "code": "spam_phishing_tool", "count": 29, "denominator": 310, "share": 0.0935, "note": "direct, service and buyer-request posts only" }, { "domain": "tooling", "dimension": "tool_type_offers_and_requests", "code": "crypter", "count": 25, "denominator": 310, "share": 0.0806, "note": "direct, service and buyer-request posts only" }, { "domain": "tooling", "dimension": "tool_type_offers_and_requests", "code": "c2_or_botnet_panel", "count": 7, "denominator": 310, "share": 0.0226, "note": "direct, service and buyer-request posts only" }, { "domain": "tooling", "dimension": "tool_type_offers_and_requests", "code": "stealer", "count": 7, "denominator": 310, "share": 0.0226, "note": "direct, service and buyer-request posts only" }, { "domain": "tooling", "dimension": "tool_type_offers_and_requests", "code": "av_edr_bypass_service", "count": 7, "denominator": 310, "share": 0.0226, "note": "direct, service and buyer-request posts only" }, { "domain": "tooling", "dimension": "tool_type_offers_and_requests", "code": "loader_dropper", "count": 5, "denominator": 310, "share": 0.0161, "note": "direct, service and buyer-request posts only" }, { "domain": "tooling", "dimension": "tool_type_offers_and_requests", "code": "obfuscator_packer", "count": 4, "denominator": 310, "share": 0.0129, "note": "direct, service and buyer-request posts only" }, { "domain": "tooling", "dimension": "tool_type_offers_and_requests", "code": "ransomware_builder_or_edr_killer", "count": 3, "denominator": 310, "share": 0.0097, "note": "direct, service and buyer-request posts only" }, { "domain": "tooling", "dimension": "tool_type_offers_and_requests", "code": "stresser", "count": 2, "denominator": 310, "share": 0.0065, "note": "direct, service and buyer-request posts only" }, { "domain": "tooling", "dimension": "commercial_unit_strict_offers", "code": "unstated", "count": 110, "denominator": 169, "share": 0.6509, "note": "strict direct and service offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_strict_offers", "code": "lifetime", "count": 24, "denominator": 169, "share": 0.142, "note": "strict direct and service offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_strict_offers", "code": "monthly", "count": 21, "denominator": 169, "share": 0.1243, "note": "strict direct and service offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_strict_offers", "code": "per_file_or_crypt", "count": 11, "denominator": 169, "share": 0.0651, "note": "strict direct and service offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_strict_offers", "code": "one_off_purchase", "count": 8, "denominator": 169, "share": 0.0473, "note": "strict direct and service offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_strict_offers", "code": "multi_month", "count": 7, "denominator": 169, "share": 0.0414, "note": "strict direct and service offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_strict_offers", "code": "source_code", "count": 7, "denominator": 169, "share": 0.0414, "note": "strict direct and service offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_strict_offers", "code": "rent", "count": 3, "denominator": 169, "share": 0.0178, "note": "strict direct and service offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_strict_offers", "code": "free", "count": 1, "denominator": 169, "share": 0.0059, "note": "strict direct and service offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_strict_offers", "code": "weekly", "count": 1, "denominator": 169, "share": 0.0059, "note": "strict direct and service offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_strict_offers", "code": "daily", "count": 1, "denominator": 169, "share": 0.0059, "note": "strict direct and service offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_strict_offers", "code": "profit_share", "count": 1, "denominator": 169, "share": 0.0059, "note": "strict direct and service offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "seller_term_stated_strict_offers", "code": "fudclaim", "count": 33, "denominator": 169, "share": 0.1953, "note": "a record can state several terms; absence is not evidence of absence" }, { "domain": "tooling", "dimension": "seller_term_stated_strict_offers", "code": "escrow", "count": 19, "denominator": 169, "share": 0.1124, "note": "a record can state several terms; absence is not evidence of absence" }, { "domain": "tooling", "dimension": "seller_term_stated_strict_offers", "code": "supp", "count": 17, "denominator": 169, "share": 0.1006, "note": "a record can state several terms; absence is not evidence of absence" }, { "domain": "tooling", "dimension": "seller_term_stated_strict_offers", "code": "upd", "count": 12, "denominator": 169, "share": 0.071, "note": "a record can state several terms; absence is not evidence of absence" }, { "domain": "tooling", "dimension": "seller_term_stated_strict_offers", "code": "trial", "count": 9, "denominator": 169, "share": 0.0533, "note": "a record can state several terms; absence is not evidence of absence" }, { "domain": "tooling", "dimension": "seller_term_stated_strict_offers", "code": "rebuild", "count": 5, "denominator": 169, "share": 0.0296, "note": "a record can state several terms; absence is not evidence of absence" }, { "domain": "tooling", "dimension": "seller_term_stated_strict_offers", "code": "proof", "count": 5, "denominator": 169, "share": 0.0296, "note": "a record can state several terms; absence is not evidence of absence" }, { "domain": "tooling", "dimension": "seller_term_stated_strict_offers", "code": "host", "count": 3, "denominator": 169, "share": 0.0178, "note": "a record can state several terms; absence is not evidence of absence" }, { "domain": "tooling", "dimension": "seller_term_stated_strict_offers", "code": "refund", "count": 2, "denominator": 169, "share": 0.0118, "note": "a record can state several terms; absence is not evidence of absence" }, { "domain": "tooling", "dimension": "seller_term_stated_strict_offers", "code": "hwid", "count": 1, "denominator": 169, "share": 0.0059, "note": "a record can state several terms; absence is not evidence of absence" }, { "domain": "tooling", "dimension": "seller_term_stated_non_bundle_offers", "code": "fudclaim", "count": 33, "denominator": 121, "share": 0.2727, "note": "strict direct and service offers excluding one reposted Turkish bundle advert (48 posts, almost no seller terms); a record can state several terms" }, { "domain": "tooling", "dimension": "seller_term_stated_non_bundle_offers", "code": "escrow", "count": 19, "denominator": 121, "share": 0.157, "note": "strict direct and service offers excluding one reposted Turkish bundle advert (48 posts, almost no seller terms); a record can state several terms" }, { "domain": "tooling", "dimension": "seller_term_stated_non_bundle_offers", "code": "supp", "count": 16, "denominator": 121, "share": 0.1322, "note": "strict direct and service offers excluding one reposted Turkish bundle advert (48 posts, almost no seller terms); a record can state several terms" }, { "domain": "tooling", "dimension": "seller_term_stated_non_bundle_offers", "code": "upd", "count": 12, "denominator": 121, "share": 0.0992, "note": "strict direct and service offers excluding one reposted Turkish bundle advert (48 posts, almost no seller terms); a record can state several terms" }, { "domain": "tooling", "dimension": "seller_term_stated_non_bundle_offers", "code": "trial", "count": 9, "denominator": 121, "share": 0.0744, "note": "strict direct and service offers excluding one reposted Turkish bundle advert (48 posts, almost no seller terms); a record can state several terms" }, { "domain": "tooling", "dimension": "seller_term_stated_non_bundle_offers", "code": "rebuild", "count": 5, "denominator": 121, "share": 0.0413, "note": "strict direct and service offers excluding one reposted Turkish bundle advert (48 posts, almost no seller terms); a record can state several terms" }, { "domain": "tooling", "dimension": "seller_term_stated_non_bundle_offers", "code": "proof", "count": 5, "denominator": 121, "share": 0.0413, "note": "strict direct and service offers excluding one reposted Turkish bundle advert (48 posts, almost no seller terms); a record can state several terms" }, { "domain": "tooling", "dimension": "seller_term_stated_non_bundle_offers", "code": "host", "count": 3, "denominator": 121, "share": 0.0248, "note": "strict direct and service offers excluding one reposted Turkish bundle advert (48 posts, almost no seller terms); a record can state several terms" }, { "domain": "tooling", "dimension": "seller_term_stated_non_bundle_offers", "code": "refund", "count": 1, "denominator": 121, "share": 0.0083, "note": "strict direct and service offers excluding one reposted Turkish bundle advert (48 posts, almost no seller terms); a record can state several terms" }, { "domain": "tooling", "dimension": "commercial_unit_non_bundle_offers", "code": "unstated", "count": 65, "denominator": 121, "share": 0.5372, "note": "same 121 non-bundle offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_non_bundle_offers", "code": "lifetime", "count": 21, "denominator": 121, "share": 0.1736, "note": "same 121 non-bundle offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_non_bundle_offers", "code": "monthly", "count": 18, "denominator": 121, "share": 0.1488, "note": "same 121 non-bundle offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_non_bundle_offers", "code": "per_file_or_crypt", "count": 11, "denominator": 121, "share": 0.0909, "note": "same 121 non-bundle offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_non_bundle_offers", "code": "one_off_purchase", "count": 8, "denominator": 121, "share": 0.0661, "note": "same 121 non-bundle offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_non_bundle_offers", "code": "multi_month", "count": 7, "denominator": 121, "share": 0.0579, "note": "same 121 non-bundle offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_non_bundle_offers", "code": "source_code", "count": 7, "denominator": 121, "share": 0.0579, "note": "same 121 non-bundle offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_non_bundle_offers", "code": "rent", "count": 3, "denominator": 121, "share": 0.0248, "note": "same 121 non-bundle offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_non_bundle_offers", "code": "free", "count": 1, "denominator": 121, "share": 0.0083, "note": "same 121 non-bundle offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_non_bundle_offers", "code": "weekly", "count": 1, "denominator": 121, "share": 0.0083, "note": "same 121 non-bundle offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_non_bundle_offers", "code": "daily", "count": 1, "denominator": 121, "share": 0.0083, "note": "same 121 non-bundle offers; unstated means no unit named in the text" }, { "domain": "tooling", "dimension": "commercial_unit_non_bundle_offers", "code": "profit_share", "count": 1, "denominator": 121, "share": 0.0083, "note": "same 121 non-bundle offers; unstated means no unit named in the text" } ], "precision": [ { "domain": "tooling", "set": "ALL_CLASSIFIED", "on_topic": 182, "n": 700, "share": 0.26, "wilson_low": 0.229, "wilson_high": 0.294, "basis": "overall; on-topic = strict (offer or request of in-scope tool types)" }, { "domain": "tooling", "set": "c_malware", "on_topic": 14, "n": 55, "share": 0.2545, "wilson_low": 0.158, "wilson_high": 0.383, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "c_c2_panel", "on_topic": 3, "n": 58, "share": 0.0517, "wilson_low": 0.018, "wilson_high": 0.141, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "c_attack_tools", "on_topic": 44, "n": 125, "share": 0.352, "wilson_low": 0.274, "wilson_high": 0.439, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "c_script_sharing", "on_topic": 0, "n": 81, "share": 0.0, "wilson_low": 0, "wilson_high": 0.045, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "c_ttp", "on_topic": 0, "n": 75, "share": 0.0, "wilson_low": 0, "wilson_high": 0.049, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "x_crypter", "on_topic": 54, "n": 70, "share": 0.7714, "wilson_low": 0.66, "wilson_high": 0.854, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "x_fud", "on_topic": 12, "n": 33, "share": 0.3636, "wilson_low": 0.222, "wilson_high": 0.534, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "x_loader", "on_topic": 0, "n": 22, "share": 0.0, "wilson_low": 0.0, "wilson_high": 0.149, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "x_hvnc", "on_topic": 30, "n": 51, "share": 0.5882, "wilson_low": 0.452, "wilson_high": 0.712, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "x_obfuscator", "on_topic": 19, "n": 91, "share": 0.2088, "wilson_low": 0.138, "wilson_high": 0.303, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "x_av_bypass", "on_topic": 14, "n": 25, "share": 0.56, "wilson_low": 0.371, "wilson_high": 0.733, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "x_xworm", "on_topic": 11, "n": 24, "share": 0.4583, "wilson_low": 0.279, "wilson_high": 0.649, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "x_asyncrat", "on_topic": 5, "n": 12, "share": 0.4167, "wilson_low": 0.193, "wilson_high": 0.68, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "x_remcos", "on_topic": 9, "n": 19, "share": 0.4737, "wilson_low": 0.273, "wilson_high": 0.683, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "x_dcrat", "on_topic": 1, "n": 6, "share": 0.1667, "wilson_low": 0.03, "wilson_high": 0.564, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "x_c2_panel", "on_topic": 8, "n": 17, "share": 0.4706, "wilson_low": 0.262, "wilson_high": 0.69, "basis": "source-set membership (sets overlap); strict on-topic" }, { "domain": "tooling", "set": "x_botnet_panel", "on_topic": 3, "n": 4, "share": 0.75, "wilson_low": 0.301, "wilson_high": 0.954, "basis": "source-set membership (sets overlap); strict on-topic" } ], "agreement": [ { "domain": "tooling", "measure": "intent", "n": 120, "agree_raw": 0.7417, "kappa": 0.687, "kappa_ci_low": 0.597, "kappa_ci_high": 0.781, "design_weighted_kappa": 0.5842, "note": "" }, { "domain": "tooling", "measure": "binary_strict_on_topic_offer", "n": 120, "agree_raw": 0.9667, "kappa": 0.9164, "kappa_ci_low": 0.822, "kappa_ci_high": 0.981, "design_weighted_kappa": 0.957, "note": "" }, { "domain": "tooling", "measure": "binary_offer_intent_only", "n": 120, "agree_raw": 0.8917, "kappa": 0.7797, "kappa_ci_low": 0.667, "kappa_ci_high": 0.883, "design_weighted_kappa": 0.6292, "note": "" }, { "domain": "tooling", "measure": "tool_type_both_offers", "n": 63, "agree_raw": 0.9048, "kappa": 0.885, "kappa_ci_low": 0.783, "kappa_ci_high": 0.962, "design_weighted_kappa": "", "note": "" }, { "domain": "tooling", "measure": "tool_type_collapsed_both_offers", "n": 63, "agree_raw": 0.9524, "kappa": 0.9276, "kappa_ci_low": 0.831, "kappa_ci_high": 1.0, "design_weighted_kappa": "", "note": "" }, { "domain": "tooling", "measure": "fud_claim_all", "n": 120, "agree_raw": 0.925, "kappa": 0.5694, "kappa_ci_low": 0.27, "kappa_ci_high": 0.791, "design_weighted_kappa": "", "note": "prevalence skew; read raw agreement" }, { "domain": "tooling", "measure": "fud_claim_both_offers", "n": 63, "agree_raw": 0.9048, "kappa": 0.6494, "kappa_ci_low": 0.368, "kappa_ci_high": 0.871, "design_weighted_kappa": "", "note": "" }, { "domain": "tooling", "measure": "commercial_unit_stated_vs_unstated_both_offers", "n": 63, "agree_raw": 0.8254, "kappa": 0.6335, "kappa_ci_low": 0.432, "kappa_ci_high": 0.811, "design_weighted_kappa": "", "note": "" }, { "domain": "tooling", "measure": "intent_in_scope_subset_both_not_not_tooling", "n": 74, "agree_raw": 0.7973, "kappa": 0.7334, "kappa_ci_low": 0.605, "kappa_ci_high": 0.846, "design_weighted_kappa": "", "note": "" }, { "domain": "tooling", "measure": "intent_with_offer_collapsed_in_scope", "n": 74, "agree_raw": 0.9189, "kappa": 0.8636, "kappa_ci_low": 0.759, "kappa_ci_high": 0.956, "design_weighted_kappa": "", "note": "" } ] }, "ai": { "label": "AI-assisted crime tools", "classification": [ { "domain": "ai", "dimension": "intent_pool_a_distinct_texts", "code": "access_resale_offer", "count": 124, "denominator": 607, "share": 0.2043, "note": "named-tool pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_a_distinct_texts", "code": "noise", "count": 117, "denominator": 607, "share": 0.1928, "note": "named-tool pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_a_distinct_texts", "code": "free_share", "count": 82, "denominator": 607, "share": 0.1351, "note": "named-tool pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_a_distinct_texts", "code": "buyer_request", "count": 70, "denominator": 607, "share": 0.1153, "note": "named-tool pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_a_distinct_texts", "code": "discussion_question", "count": 66, "denominator": 607, "share": 0.1087, "note": "named-tool pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_a_distinct_texts", "code": "tool_named_inside_other_service_ad", "count": 54, "denominator": 607, "share": 0.089, "note": "named-tool pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_a_distinct_texts", "code": "unclear", "count": 35, "denominator": 607, "share": 0.0577, "note": "named-tool pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_a_distinct_texts", "code": "subscription_offer", "count": 24, "denominator": 607, "share": 0.0395, "note": "named-tool pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_a_distinct_texts", "code": "prompt_or_jailbreak_pack_sale", "count": 15, "denominator": 607, "share": 0.0247, "note": "named-tool pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_a_distinct_texts", "code": "news_or_research_relay", "count": 10, "denominator": 607, "share": 0.0165, "note": "named-tool pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_a_distinct_texts", "code": "name_used_as_brand_for_other_service", "count": 5, "denominator": 607, "share": 0.0082, "note": "named-tool pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_a_distinct_texts", "code": "service_user_data_leak_post", "count": 4, "denominator": 607, "share": 0.0066, "note": "named-tool pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_a_distinct_texts", "code": "scam_or_fake_warning", "count": 1, "denominator": 607, "share": 0.0016, "note": "named-tool pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_b_distinct_texts", "code": "access_resale_offer", "count": 32, "denominator": 107, "share": 0.2991, "note": "generic uncensored-AI pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_b_distinct_texts", "code": "noise", "count": 23, "denominator": 107, "share": 0.215, "note": "generic uncensored-AI pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_b_distinct_texts", "code": "free_share", "count": 12, "denominator": 107, "share": 0.1121, "note": "generic uncensored-AI pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_b_distinct_texts", "code": "discussion_question", "count": 8, "denominator": 107, "share": 0.0748, "note": "generic uncensored-AI pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_b_distinct_texts", "code": "subscription_offer", "count": 8, "denominator": 107, "share": 0.0748, "note": "generic uncensored-AI pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_b_distinct_texts", "code": "tool_named_inside_other_service_ad", "count": 7, "denominator": 107, "share": 0.0654, "note": "generic uncensored-AI pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_b_distinct_texts", "code": "buyer_request", "count": 6, "denominator": 107, "share": 0.0561, "note": "generic uncensored-AI pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_b_distinct_texts", "code": "news_or_research_relay", "count": 6, "denominator": 107, "share": 0.0561, "note": "generic uncensored-AI pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_b_distinct_texts", "code": "prompt_or_jailbreak_pack_sale", "count": 2, "denominator": 107, "share": 0.0187, "note": "generic uncensored-AI pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_b_distinct_texts", "code": "unclear", "count": 2, "denominator": 107, "share": 0.0187, "note": "generic uncensored-AI pool, distinct texts" }, { "domain": "ai", "dimension": "intent_pool_b_distinct_texts", "code": "name_used_as_brand_for_other_service", "count": 1, "denominator": 107, "share": 0.0093, "note": "generic uncensored-AI pool, distinct texts" }, { "domain": "ai", "dimension": "offer_type_pools_a_b", "code": "access_resale_offer", "count": 156, "denominator": 211, "share": 0.7393, "note": "offer-type = access resale + subscription + prompt pack + name reused for another service" }, { "domain": "ai", "dimension": "offer_type_pools_a_b", "code": "subscription_offer", "count": 32, "denominator": 211, "share": 0.1517, "note": "offer-type = access resale + subscription + prompt pack + name reused for another service" }, { "domain": "ai", "dimension": "offer_type_pools_a_b", "code": "prompt_or_jailbreak_pack_sale", "count": 17, "denominator": 211, "share": 0.0806, "note": "offer-type = access resale + subscription + prompt pack + name reused for another service" }, { "domain": "ai", "dimension": "offer_type_pools_a_b", "code": "name_used_as_brand_for_other_service", "count": 6, "denominator": 211, "share": 0.0284, "note": "offer-type = access resale + subscription + prompt pack + name reused for another service" } ], "precision": [ { "domain": "ai", "set": "k_wormgpt", "on_topic": 147, "n": 541, "share": 0.2717, "wilson_low": 0.236, "wilson_high": 0.311, "basis": "set; distinct texts; on-topic = offer-type" }, { "domain": "ai", "set": "k_fraudgpt", "on_topic": 5, "n": 28, "share": 0.1786, "wilson_low": 0.079, "wilson_high": 0.356, "basis": "set; distinct texts; on-topic = offer-type" }, { "domain": "ai", "set": "x_ghostgpt", "on_topic": 1, "n": 5, "share": 0.2, "wilson_low": 0.036, "wilson_high": 0.624, "basis": "set; distinct texts; on-topic = offer-type" }, { "domain": "ai", "set": "x_xanthorox", "on_topic": 0, "n": 6, "share": 0.0, "wilson_low": 0.0, "wilson_high": 0.39, "basis": "set; distinct texts; on-topic = offer-type" }, { "domain": "ai", "set": "x_darkgpt", "on_topic": 9, "n": 24, "share": 0.375, "wilson_low": 0.212, "wilson_high": 0.573, "basis": "set; distinct texts; on-topic = offer-type" }, { "domain": "ai", "set": "x_evilgpt", "on_topic": 13, "n": 26, "share": 0.5, "wilson_low": 0.321, "wilson_high": 0.679, "basis": "set; distinct texts; on-topic = offer-type" }, { "domain": "ai", "set": "x_nytheon", "on_topic": 0, "n": 2, "share": 0.0, "wilson_low": 0.0, "wilson_high": 0.658, "basis": "set; distinct texts; on-topic = offer-type" }, { "domain": "ai", "set": "x_uncensored_ai", "on_topic": 47, "n": 116, "share": 0.4052, "wilson_low": 0.32, "wilson_high": 0.496, "basis": "set; distinct texts; on-topic = offer-type" }, { "domain": "ai", "set": "x_malicious_ai", "on_topic": 0, "n": 7, "share": 0.0, "wilson_low": 0.0, "wilson_high": 0.354, "basis": "set; distinct texts; on-topic = offer-type" }, { "domain": "ai", "set": "pool_A_named", "on_topic": 168, "n": 607, "share": 0.2768, "wilson_low": 0.243, "wilson_high": 0.314, "basis": "pool of distinct texts; on-topic = offer-type" }, { "domain": "ai", "set": "pool_B_generic", "on_topic": 43, "n": 107, "share": 0.4019, "wilson_low": 0.314, "wilson_high": 0.497, "basis": "pool of distinct texts; on-topic = offer-type" }, { "domain": "ai", "set": "k_jailbreak_sample", "on_topic": 43, "n": 150, "share": 0.2867, "wilson_low": 0.22, "wilson_high": 0.364, "basis": "random sample of the retained set; on-topic = offer-type" }, { "domain": "ai", "set": "k_deepfake_sample", "on_topic": 39, "n": 150, "share": 0.26, "wilson_low": 0.196, "wilson_high": 0.336, "basis": "random sample of the retained set; on-topic = offer-type" } ], "agreement": [ { "domain": "ai", "measure": "intent", "n": 120, "agree_raw": 0.7083, "kappa": 0.6792, "kappa_ci_low": 0.59, "kappa_ci_high": 0.767, "design_weighted_kappa": 0.7068, "note": "" }, { "domain": "ai", "measure": "binary_offer_type", "n": 120, "agree_raw": 0.8667, "kappa": 0.7222, "kappa_ci_low": 0.588, "kappa_ci_high": 0.839, "design_weighted_kappa": 0.7163, "note": "" }, { "domain": "ai", "measure": "binary_broad_offer_incl_inos_and_deepfake", "n": 120, "agree_raw": 0.8833, "kappa": 0.7656, "kappa_ci_low": 0.646, "kappa_ci_high": 0.867, "design_weighted_kappa": "", "note": "" }, { "domain": "ai", "measure": "claimed_capability_first_listed_both_offers", "n": 39, "agree_raw": 0.7179, "kappa": 0.2513, "kappa_ci_low": -0.002, "kappa_ci_high": 0.521, "design_weighted_kappa": "", "note": "weak; indicative only" }, { "domain": "ai", "measure": "underlying_model_named_all", "n": 120, "agree_raw": 0.8833, "kappa": 0.2391, "kappa_ci_low": -0.057, "kappa_ci_high": 0.503, "design_weighted_kappa": "", "note": "low kappa; share not published" }, { "domain": "ai", "measure": "underlying_model_named_both_offers", "n": 39, "agree_raw": 0.7436, "kappa": 0.1631, "kappa_ci_low": -0.14, "kappa_ci_high": 0.497, "design_weighted_kappa": "", "note": "low kappa; share not published" }, { "domain": "ai", "measure": "underlying_model_named_excluding_jailbreak_pack_and_free_share", "n": 95, "agree_raw": 0.9684, "kappa": 0.3897, "kappa_ci_low": 0.0, "kappa_ci_high": 1.0, "design_weighted_kappa": "", "note": "" }, { "domain": "ai", "measure": "claimed_capability_both_offers_first_coder_nonblank", "n": 30, "agree_raw": 0.9333, "kappa": 0.6923, "kappa_ci_low": 0.0, "kappa_ci_high": 1.0, "design_weighted_kappa": "", "note": "" } ] } }, "agreement_headline_shifts": { "exploit": { "first_coder_share": 0.307, "second_reader_share": 0.2573, "shift_points": -4.97 }, "tooling": { "first_coder_share": 0.2319, "second_reader_share": 0.2197, "shift_points": -1.22 }, "ai": { "first_coder_share": 0.2498, "second_reader_share": 0.2129, "shift_points": -3.69 }, "note": "Shares if the second reader’s labels replaced the first coder’s, on each domain’s agreement frame; bootstrap of the recode sample only." }, "catalogue_recheck": { "records": 99, "by_domain": { "exploit": 35, "tooling": 34, "ai": 30 }, "hash_ok": 99, "fragments_ok_exact": 91, "fragments_ok_after_whitespace_normalisation": 99, "fragments_checked": 231, "privacy_ok": 99, "paraphrase_supported": { "yes": 79, "partly": 19, "no": 1 }, "defects_by_severity": { "minor": 11, "moderate": 6, "trivial": 3 }, "privacy_method": "Automated privacy checks and evidence-fragment comparisons were performed on the public catalogue. Rechecks do not establish a dated full read of every original record; record-specific reading-depth limits apply, including the partial read of XT-A025.", "other_checks": "date, platform type matched the stored post for all 99; every digit string in price_display occurs in the stored text; KEV dates for E007/E016/E017/E023/E028 agree with the kev_added data in the pipeline ledger (CISA itself not consulted, local only).", "basis": "Counts describe the 99 records as first checked by the second reader, before the 30 Oct fixes; the version-specific correction record identifies subsequent changes; these counts do not certify the current catalogue." }, "limitations": [ "Counts are Blackhole-collected post IDs or distinct texts, not offers, sellers, sales, victims or people. One offer can appear in many posts.", "Telegram supplies 63% and forums 33% of the exploit sample, 81% and 16% of the tooling sample. Forums are under 1% of the Blackhole corpus and are over-represented here by the sets searched; closed forums, brokers and Tor are barely collected, so this is not a view of the dark web as a whole.", "One reposted Turkish bundle advert (several wording variants) is 48 of the 182 strict tooling on-topic posts and 48 of the 169 strict direct and service offers; without it the strict share is 20.6%. Tooling seller-term shares use the 121 offers outside it, because it carries almost no seller terms.", "Exploit seller bases differ on purpose: 182 for the 0-day label statistics and 193 for price and object statistics (the difference is 11 off-topic commercial posts).", "Class labels are not comparable across May to July 2026 (taxonomy break). No monthly trend is published; sets-monthly.csv carries a warning column.", "The exploit and tooling classifications are stratified samples of commercial-signal pools read by one AI first coder; pool-level figures are sample shares or weighted estimates, not counts. Wilson intervals ignore the stratified design.", "One AI second reader recoded 120 records per domain. Agreement is inter-coder, not accuracy; Brandefense analysts approved the findings.", "The commercial-signal filter caught about 69% of on-topic exploit records in an indicative recall check, so offer counts are lower bounds.", "Prices are advertised asking terms. A bare dollar sign is not read as USD; no conversion, average or price index is produced.", "The 99 catalogue records are purposive and diversity-seeking; they do not estimate prevalence and are not 99 sellers.", "No exploit or tool was bought, run or tested; every capability is a text claim. A CVE relation uses 2026 CISA catalogue additions only and is not an early-warning claim.", "The share of AI offer texts that name a backend model is not published (second-reader kappa 0.24); the hosted-access coding of 141 texts had one reader and its backend counts are indicative.", "AI figures use three frames: pool A (607 texts, 168 offer-type), pools A and B (714 texts, 211 offer-type) and the agreement ledger (1,009 post IDs); the chapter uses pool A unless it says otherwise.", "Months can gain posts after collection (back-fill); re-pull before reuse." ], "findings": [ { "id": "zero-day-label", "title": "Only 37 of 93 exploit seller posts using the word 0-day were coded as unnamed-exploit claims.", "text": "Among 182 exploit seller posts in a stratified sample of 700 classified Blackhole posts, 93 (51.1%) use 0-day or zero-day. Only 37 were coded as unnamed-exploit claims, a broad code that also covers research services, lists and chains. The rest are menus and other goods (25), mass tools (12), unlicensed/shared-tool bundles (8), feeds (5), kits (3) and 3 other items. None of the 93 gives a CVE; only 2 of all 221 offers and requests name one.", "evidence": "classification-summary.csv (exploit, zero_day_label_use_by_object; cve_status)", "limit": "Base: 182 = 193 direct and service seller posts minus 11 off-topic. Sampled post IDs from a collection dominated by Telegram. A 0-day may have no public CVE yet, and sellers may omit identifiers, so a missing CVE is not proof of a false claim. Not a market measure.", "one_line": "Only 37 of 93 exploit seller posts using the word 0-day were coded as unnamed-exploit claims, and none names a CVE." }, { "id": "tools-and-shells", "title": "Tools and web shells are comparable in number to coded exploit-claim posts.", "text": "Among 193 seller posts (the base for object and price counts), 56 sell a mass-exploitation tool or the web shells it produces. Another 47 are coded exploit-claim posts (unnamed-exploit, CVE-named or public-PoC codes). Web software is the largest stated target class (95 of 221 records, 43.0%); 71 name no target.", "evidence": "classification-summary.csv (exploit, offered_object, target_class)", "limit": "Derived sums of coded categories with a small margin, so the two groups are comparable rather than ranked; capabilities are text claims and no exploit was run. Not seller or sales counts.", "one_line": "56 exploit seller posts sell tools or shells and 47 are coded exploit-claim posts, out of 193." }, { "id": "price-tiers", "title": "Within single ads, price tiers separate copies, exclusivity, devices or service.", "text": "In the six ads compared, price tiers separate copies, exclusivity, device counts or a service. No priced seller post gives a CVE identifier: 70 of 193 seller posts show a stated amount, and the 2 CVE-named offers show none. So claimed capability or target cannot be ruled out as the driver.", "evidence": "evidence-catalogue.csv; price-terms.csv", "limit": "Six purposive catalogue ads, not a sample. Asking prices, not sales; a bare dollar sign is not USD. No averages or price index.", "one_line": "Price tiers inside individual exploit ads separate copies, exclusivity, devices or service; no priced ad names a flaw." }, { "id": "fud-claims", "title": "Tooling ads promise supply, not a detection outcome.", "text": "One reposted Turkish bundle advert is 48 of the 169 strict direct and service tooling offers. Of the other 121, 33 claim FUD or undetectability (27.3%) and 1 states a window (three days). Written seller duties are rare: support 16, updates 12, rebuild 5, refund 1, while 19 name escrow, a payment protection. Of 29 crypter, loader and AV-bypass offers, 18 claim FUD, 2 a rebuild and 1 a refund.", "evidence": "classification-summary.csv (tooling, seller_term_stated_non_bundle_offers); chart-seller-obligations", "limit": "Flags record what the ad text stated; absence is not evidence of absence. FUD-flag kappa 0.57. The bundle advert, reposted in several wording variants, is 48 of the 182 strict posts and carries almost no seller terms, so shares on all 169 offers are lower (FUD 19.5%); without it the strict share is 20.6%. Terms may be agreed in private messages.", "one_line": "33 of 121 non-bundle strict tooling offers make a FUD claim; one states a duration." }, { "id": "wormgpt-name", "title": "AI-branded tool names mostly label an access point or a prompt.", "text": "Of 607 distinct named-tool texts, 168 are offer-type (27.7%). Of 141 hosted-access texts, 122 state no backend model; 15 offers are prompt packs, and brand names also collide with unrelated services. The backend field has second-reader kappa 0.24, so backend counts are indicative.", "evidence": "classification-summary.csv (ai); agreement.csv (ai); chart-ai-offer-mix", "limit": "Single first coder plus one AI second reader; the offer-type boundary is soft. Texts are advertised claims; no tool was bought or tested.", "one_line": "168 of 607 distinct texts from seven AI-branded tool searches are offer-type; the names mostly label an access point or a prompt." }, { "id": "keyword-precision", "title": "Raw keyword counts overstate offers.", "text": "Only 31.6% of the 700 classified exploit posts were offers or requests; for posts matched by the keyword 0day alone the share was 23.0% (51 of 222). In the tooling sample 182 of 700 posts (26.0%) were strict on-topic offers.", "evidence": "precision.csv; chart-precision", "limit": "Precision is measured on a stratified sample of each commercial-signal pool; intervals ignore the stratified design; sets with n below 25 are indicative only.", "one_line": "Only 31.6% of classified exploit-keyword posts were offers or requests." } ], "assets": { "manifest": "exploit-trade-data.json", "classification_csv": "classification-summary.csv", "precision_csv": "precision.csv", "agreement_csv": "agreement.csv", "windows_csv": "retrieval-windows.csv", "sets_monthly_csv": "sets-monthly.csv", "catalogue_csv": "evidence-catalogue.csv", "price_terms_csv": "price-terms.csv", "unit_csv": "counting-units.csv", "catalogue_html": "evidence-catalogue.html", "dictionary": "data-dictionary.html", "methodology": "methodology.html", "license": "license.html", "press": "press-kit.html", "charts": [ { "id": "what-is-on-sale", "title": "What is on sale in exploit offers and requests", "svg": "chart-what-is-on-sale.svg", "png": "chart-what-is-on-sale.png", "alt": "Bar chart of the offered object in 221 exploit offers and requests, led by unnamed 0-day claims (57) and mass-exploitation tools (36); 2 are private exploits that name a CVE.", "denominator": "221 offers and requests", "data": [ { "label": "Unnamed 0-day claim", "count": 57, "share_pct": 25.8 }, { "label": "Other or mixed object", "count": 44, "share_pct": 19.9 }, { "label": "Mass-exploitation tool", "count": 36, "share_pct": 16.3 }, { "label": "Web shells or access result", "count": 31, "share_pct": 14.0 }, { "label": "Exploit-feed subscription", "count": 12, "share_pct": 5.4 }, { "label": "Commercial, not exploit-related", "count": 11, "share_pct": 5.0 }, { "label": "Unlicensed or shared-tool bundle", "count": 8, "share_pct": 3.6 }, { "label": "Exploit kit or builder", "count": 6, "share_pct": 2.7 }, { "label": "Checker or scanner only", "count": 4, "share_pct": 1.8 }, { "label": "Course", "count": 4, "share_pct": 1.8 }, { "label": "Repackaged public PoC", "count": 3, "share_pct": 1.4 }, { "label": "Named product, no CVE", "count": 3, "share_pct": 1.4 }, { "label": "Private exploit, CVE named", "count": 2, "share_pct": 0.9 } ] }, { "id": "precision", "title": "Share of retained posts that were on-topic offers or requests", "svg": "chart-precision.svg", "png": "chart-precision.png", "alt": "Dot-and-interval chart: the share of classified posts or texts that were on-topic offers or requests ranges from about 5% to 80% by search, against 31.6% for all exploit posts, 26.0% for tooling and 27.7% for AI named-tool texts.", "denominator": "sample sizes per row", "data": [ { "label": "Exploits: all sampled", "on_topic": 221, "n": 700, "share_pct": 31.6, "wilson_low_pct": 28.2, "wilson_high_pct": 35.1 }, { "label": "Keyword '0day'", "on_topic": 51, "n": 222, "share_pct": 23.0, "wilson_low_pct": 17.9, "wilson_high_pct": 28.9 }, { "label": "Keyword 'zero day'", "on_topic": 55, "n": 210, "share_pct": 26.2, "wilson_low_pct": 20.7, "wilson_high_pct": 32.5 }, { "label": "Keyword 'exploit'", "on_topic": 23, "n": 47, "share_pct": 48.9, "wilson_low_pct": 35.3, "wilson_high_pct": 62.8 }, { "label": "Zero-day class label", "on_topic": 36, "n": 67, "share_pct": 53.7, "wilson_low_pct": 41.9, "wilson_high_pct": 65.1 }, { "label": "Query 'private exploit'", "on_topic": 28, "n": 35, "share_pct": 80.0, "wilson_low_pct": 64.1, "wilson_high_pct": 90.0 }, { "label": "Tooling: all sampled", "on_topic": 182, "n": 700, "share_pct": 26.0, "wilson_low_pct": 22.9, "wilson_high_pct": 29.4 }, { "label": "Malware class label", "on_topic": 14, "n": 55, "share_pct": 25.5, "wilson_low_pct": 15.8, "wilson_high_pct": 38.3 }, { "label": "C2-panel class label", "on_topic": 3, "n": 58, "share_pct": 5.2, "wilson_low_pct": 1.8, "wilson_high_pct": 14.1 }, { "label": "Attack-tools class label", "on_topic": 44, "n": 125, "share_pct": 35.2, "wilson_low_pct": 27.4, "wilson_high_pct": 43.9 }, { "label": "Query 'crypter'", "on_topic": 54, "n": 70, "share_pct": 77.1, "wilson_low_pct": 66.0, "wilson_high_pct": 85.4 }, { "label": "AI: named-tool texts", "on_topic": 168, "n": 607, "share_pct": 27.7, "wilson_low_pct": 24.3, "wilson_high_pct": 31.4 }, { "label": "Keyword 'wormgpt'", "on_topic": 147, "n": 541, "share_pct": 27.2, "wilson_low_pct": 23.6, "wilson_high_pct": 31.1 }, { "label": "Query 'uncensored AI'", "on_topic": 47, "n": 116, "share_pct": 40.5, "wilson_low_pct": 32.0, "wilson_high_pct": 49.6 }, { "label": "Keyword 'jailbreak' (sample)", "on_topic": 43, "n": 150, "share_pct": 28.7, "wilson_low_pct": 22.0, "wilson_high_pct": 36.4 } ] }, { "id": "seller-obligations", "title": "Terms stated in strict malware-tooling offers outside one bundle advert", "svg": "chart-seller-obligations.svg", "png": "chart-seller-obligations.png", "alt": "Bar chart of terms stated in 121 strict tooling offers outside one reposted bundle advert: FUD claim 33, escrow 19, support 16, updates 12, rebuild 5, hosting 3, refund or warranty 1.", "denominator": "121 strict direct and service offers (bundle advert excluded)", "data": [ { "label": "FUD or undetectable claim", "count": 33, "share_pct": 27.3 }, { "label": "Escrow mentioned (payment protection)", "count": 19, "share_pct": 15.7 }, { "label": "Support", "count": 16, "share_pct": 13.2 }, { "label": "Updates", "count": 12, "share_pct": 9.9 }, { "label": "Rebuild or re-crypt", "count": 5, "share_pct": 4.1 }, { "label": "Hosting", "count": 3, "share_pct": 2.5 }, { "label": "Refund or warranty", "count": 1, "share_pct": 0.8 } ] }, { "id": "ai-offer-mix", "title": "AI-branded tool offer texts by type (seven-brand pool)", "svg": "chart-ai-offer-mix.svg", "png": "chart-ai-offer-mix.png", "alt": "Bar chart of 168 offer-type texts among 607 distinct named-tool texts: access resale 124, subscription 24, prompt or jailbreak pack 15, name reused for another service 5.", "denominator": "168 offer-type texts", "data": [ { "label": "Chatbot access resale", "count": 124, "share_pct": 73.8 }, { "label": "Subscription", "count": 24, "share_pct": 14.3 }, { "label": "Prompt or jailbreak pack", "count": 15, "share_pct": 8.9 }, { "label": "Name reused for another service", "count": 5, "share_pct": 3.0 } ] } ], "social": { "cover": "social-cover.png", "exploits": "social-exploits.png", "tooling": "social-tooling.png", "ai": "social-ai.png" }, "pdf": "exploit-trade-report-2026.pdf", "reader": "exploit-trade-report-2026.html", "validation": "package-validation.json" }, "ai_disclosure": { "byline_line": "Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.", "method_paragraph": "Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone. Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings.", "chapter_note": "In this chapter one AI reader (Claude Sonnet 5.5) assigned the labels and a second AI reader rechecked a blind sample and every catalogue record; both are AI readers and agreement is not accuracy. Brandefense analysts approved the findings." }, "license": "CC BY 4.0 for original aggregates, charts and editorial paraphrases; raw source content is excluded.", "attribution": "Source: Brandefense Research Team, Exploits, Malware Tooling and AI-Assisted Crime, 2026, v1.0. Data: Brandefense Blackhole, 1 Jan–27 Oct 2026. Collected posts, not offers or market totals." }