The Evidence Room
๐ Part B of the Kill Chain Economy series โ TI-2026-035
Forty-eight dossiers. Five hundred eighteen investigations. Eight thousand honeypot IPs. Four thousand six hundred ninety-two OSINT library documents. Over a year of forensic work.
What do they prove?
Not what you think. Not a list of bad actors. Not a catalogue of attacks. Something worse: a system. A system so integrated that the infrastructure protecting your VPN connection is the same infrastructure launching ransomware attacks. The hosting provider serving your website is the same hosting provider serving a state intelligence operation. The shell company hiding an ASN is the same shell company hiding a money laundering network.
This is the evidence room. Every exhibit is sourced. Every claim is cross-referenced across multiple independent investigations. The evidence was not assembled to prove a thesis โ the thesis emerged because the evidence kept converging on the same ten entities, the same five jurisdictions, and the same 96% enforcement failure rate.
Exhibit A: The Five Jurisdictions That Run Everything
๐ Cross-Investigation Infrastructure Distribution
| Jurisdiction | Infrastructure Entries | Investigations | What They Host |
|---|---|---|---|
| ๐บ๐ธ United States | 80 | 28 | ColoCrossing, Psychz, SingleHop, DigitalOcean, FranTech, Google Cloud, NSA/TAO |
| ๐ณ๐ฑ Netherlands | 64 | 16 | 1337 Services, LAIN ASN sponsors, Tor exits, M247 nodes, AIVD/MIVD |
| ๐ฉ๐ช Germany | 19 | 8 | Hetzner, Contabo, 1337 Services GmbH HQ, FinFisher (Munich), BND |
| ๐ธ๐ฌ Singapore | 36 | 4 | Aceville/Tencent, Belt and Road cloud wrapper, data haven |
| ๐ธ๐จ Seychelles | recurring | 12+ | Shell company terminal, 15+ ASNs from one phone, AFRINIC extraction |
Source: [CORPUS] Cross-tabulation of infrastructure table across all 518 investigations in dossier_intel database. Each entry represents a unique infrastructure entity with documented presence in the investigation.
Five jurisdictions. Eighty-five percent of everything.
Look at that table again. The United States โ the nation that sanctioned Garantex, indicted GRU officers, and Entity Listed NSO Group โ hosts more abusive infrastructure than any other country in our corpus. Not by a small margin. By almost double the second-place Netherlands.
Now ask yourself: why?
๐ Why are these five?
Q: Is the US simply larger, hosting more of everything including abuse?
A: Partially. But ColoCrossing in Buffalo has 46 of 74 observed IPs with abuse_score=100. This is not statistical noise from scale โ this is a specific provider with a specific tolerance policy. TI-2026-032A documented this. No FBI action followed.
Q: Why the Netherlands?
A: Amsterdam Internet Exchange (AMS-IX) โ the largest internet exchange point in Europe. Excellent connectivity. Also: 1337 Services GmbH operates Tor exits and phishing relay through Dutch infrastructure. Julian Achter (LAIN) sponsors ASNs through RIPE NCC in DE/NL. The Netherlands offers connectivity AND legal process slow enough to be operationally useful.
Q: Why Seychelles?
A: Because the Seychelles Companies Act requires a registered agent but no public beneficial ownership disclosure. Phone +248-4-610-795 appears in RIPE records linking 15+ ASNs across shell companies routing 16 million IPs through AFRINIC โ an African registry โ with zero African traffic. The IPs go to EU/US data centers. The Seychelles is not where the traffic goes. It is where the ownership disappears.
Q: What do these five share?
A: The combination of: (a) reliable network connectivity, (b) legal systems that are either slow, opaque, or deliberately permissive, (c) institutional legitimacy (RIPE/ARIN membership, trade registrations, regulated banking). This combination exists in perhaps 10 jurisdictions globally. These five are the most efficient.
Exhibit B: The Ten Entities That Enable Everything
๐ธ๏ธ Cross-Investigation Entity Frequency
| Entity | Investigations | Connections | What They Enable |
|---|---|---|---|
| M247 Europe SRL ๐ท๐ด | 9 | 30+ | VPN laundering, sanctions evasion geofeeds, Macquarie Group backing |
| 1337 Services GmbH ๐ฉ๐ช | 8 | 30+ | Tor exits, phishing relay, darknet hosting, ASN sponsoring |
| Seychelles Shell Network ๐ธ๐จ | 12+ | multiple | 16M IPs via AFRINIC, ownership obfuscation, LIR sponsoring terminal |
| Aceville / Tencent Cloud ๐ธ๐ฌ | 5 | multiple | State-adjacent cloud, 86% abuse rate, Belt and Road listed |
| NordVPN / Kape Technologies ๐ฎ๐ฑ | 4+ | multiple | VPN market dominance, Unit 8200 alumni (CrossriderโKape pivot) |
| ColoCrossing LLC ๐บ๐ธ | 3+ | multiple | Buffalo NY: 46/74 IPs abuse=100. Worst US abuse rate documented |
| OVH / Contabo ๐ซ๐ท/๐ฉ๐ช | 5+ | multiple | EU commodity hosting, volume abuse, slow takedown |
| Psychz Networks ๐บ๐ธ | 3+ | multiple | LA underground: 33/36 IPs abuse=100. Second worst US provider |
| Hetzner ๐ฉ๐ช | 4+ | multiple | DE hosting backbone, commodity hosting for all use cases |
| DigitalOcean ๐บ๐ธ | 4+ | multiple | Cloud hosting, developer platform, low barrier to abuse |
Source: [CORPUS] Entity cross-investigation frequency analysis via dossier_entity() across 518 investigations.
Ten entities. Not ten shadowy criminal organizations. Ten registered companies with trade registrations, customer service departments, and LinkedIn pages. M247 is majority-owned by Macquarie Group, an ASX-listed Australian investment bank. Kape Technologies is publicly traded on the London Stock Exchange. ColoCrossing has an office in Buffalo you can visit.
These are not underground services. They are the internet's middle class โ large enough to matter, small enough to avoid scrutiny, registered in jurisdictions with enough legitimacy to deflect questions.
๐ Read between the lines
Q: If M247 is majority-owned by an ASX-listed bank, why does it appear in 9 investigations for VPN laundering and sanctions evasion?
A: Because Macquarie Group's fiduciary duty is to shareholders, not to abuse victims. M247 is profitable. NordVPN traffic is profitable. The sanctions-country geofeeds documented in TI-2026-023C are a side effect, not a business plan. But the side effect enables sanctions evasion, and the investment bank has no regulatory obligation to investigate downstream traffic. The compliance gap between financial regulation and network abuse is where M247 lives.
Q: What does it mean that ColoCrossing has 62% of its observed IPs at abuse_score=100 with no enforcement action?
A: It means the FBI's cybercrime unit in Buffalo (if it exists) either lacks resources, lacks jurisdiction, or lacks interest. ColoCrossing is not illegal โ it is a hosting provider with poor abuse response. The law does not require a hosting provider to investigate its customers. Section 230 provides broad immunity. The 96% abuse report failure rate is not a ColoCrossing problem โ it is an architectural problem.
Q: Why does Kape Technologies (formerly Crossrider, an adware company founded by Unit 8200 alumni) own three of the top five VPN providers?
A: Because privacy is a $44B market and former intelligence operatives understand the product better than anyone. ExpressVPN, CyberGhost, Private Internet Access โ all Kape. The same corporate group that distributed adware now sells privacy. The cynical reading: the surveillance state alumni control the privacy infrastructure. The business reading: they pivoted. The evidence supports both. The user cannot distinguish them.
Exhibit C: The Kill Chain Is an Economy
TI-2026-035A documented the complete pipeline: SSH probe โ credential market โ ransomware โ crypto laundering โ fiat. But 035A showed the chain as linear. It is not linear. It is a circular economy.
๐ The Circular Economy of Cybercrime
| Stage | Input | Output | Documented In |
|---|---|---|---|
| 1. Scanning | Hosting + botnet IPs | Valid credentials ($50-500 each) | Honeypot, 026O-GO |
| 2. Brokerage | Credentials | Network access packages ($500-500K) | CISA AA24-241A, CrowdStrike |
| 3. Ransomware | Access packages | Ransom payments (BTC/XMR) | FinCEN $590M, FBI IC3 $12.5B |
| 4. Laundering | Crypto proceeds | Clean fiat via high-risk exchanges | Europol, Treasury DeFi Risk |
| 5. Reinvestment | Fiat capital | New hosting, new botnets, new scanning | OFAC Aeza/Garantex sanctions |
Source: [CORPUS] Synthesis of TI-2026-035A pipeline with FinCEN SARs, Europol Crypto Tracing Report, CISA advisories, and OFAC designations.
Stage 5 is the one nobody talks about. Where does the laundered money go? Back into infrastructure. New hosting. New botnets. New scanning campaigns. The proceeds from ransomware pay for the hosting that launches the next scanning campaign that harvests the credentials that enable the next ransomware attack. The economy is self-financing.
And the leverage ratio documented in 035A? 1:44. Every dollar in credential sales generates forty-four dollars in ransomware revenue. This is a better return than venture capital.
Exhibit D: The Surveillance Pipeline
๐ต๏ธ From Government Tool to Criminal Weapon: Three Documented Pathways
- FinFisher (2011โ2014โcriminal): WikiLeaks Spy Files exposed. Source code leaked 2014. Government ISP-level surveillance product โ criminal exploitation toolkit within months. (1,063 library chunks)
- CIA Vault 7 (classifiedโ2017โcriminal): WikiLeaks published CIA hacking tools. Smart TV microphone activation, router implants, smartphone exploitation. Techniques in criminal malware within months. (105 library chunks)
- NSO Pegasus (soldโburnedโcriminal): Zero-days sold to 45+ governments. Once used, vulnerability classes are burned and recycled by criminal groups within weeks. Google TAG 2024 documents the cascade.
Source: [OSINT-LIB] WikiLeaks Spy Files (1,063 chunks), WikiLeaks Vault 7 (105 chunks), Google TAG Buying Spying 2024, Apple vs NSO Complaint 2021.
The surveillance vendor market is a one-way valve. Tools flow from classified โ commercial โ criminal. They never flow back. Export controls cannot recall leaked source code. Entity Lists cannot un-burn a zero-day. The market that creates lawful intercept tools is structurally creating criminal capability.
And the honeypot sees the result. SSH probe patterns in our data show exploitation techniques consistent with FinFisher capability profiles. Not because the attackers are FinFisher customers โ because the FinFisher source code has been public since 2014. The government tool became everyone's tool.
๐ The questions nobody asks
Q: If every surveillance tool eventually enters the criminal ecosystem, why does the market still exist?
A: Because the customers โ governments โ value current capability over future criminal proliferation. A government using Pegasus today does not bear the cost of Pegasus techniques appearing in criminal malware next year. The cost is externalized to the victims of future criminal attacks. The surveillance vendor market is a negative externality engine.
Q: Why did the US Entity List NSO Group but then acquire Paragon (same product, same Unit 8200 alumni)?
A: Because the Entity List is not a moral position. It is a market intervention. NSO was selling to Saudi Arabia, UAE, Hungary โ allies that used Pegasus against US interests (journalist Jamal Khashoggi, EU Parliament). Paragon was acquired by a US firm (AE Industrial Partners, $500M+) and re-incorporated in Delaware. The US did not oppose surveillance tools. The US opposed Israeli-controlled surveillance tools being sold to customers the US cannot control.
Q: Where does FinFly ISP fit in your honeypot data?
A: FinFly ISP is a product that installs inside an ISP network and intercepts all traffic โ precisely the same capability as NSA QUANTUM (Snowden documents). Our honeypot sits on the other end of the pipe. The SSH probes we capture traverse the same ISP infrastructure that FinFly ISP targets. We measure the attacks; FinFly ISP measures the defenders. Same pipe, different directions.
Exhibit E: State Actors Are Not a Separate Category
๐๏ธ When The Attacker IS The Government
- Microsoft Threat Intelligence, East Asia report (Sept 2023): Chinese state actors (Raspberry Typhoon, Flax Typhoon, Charcoal Typhoon) target government ministries, energy and critical infrastructure. Microsoft does not say their infrastructure is indistinguishable from criminal operators โ that is our honeypot finding, below (corrected 2026-09-26).
- Honeypot Data: Aceville/Tencent (state-adjacent cloud) โ 154 IPs, 86% abuse โฅ80. Traffic patterns statistically identical to purely criminal hosting.
- TI-2026-034 (Israel): 7 IPs from Israel in honeypot. 0 hits. Statistical absence from the world's largest exporter of offensive cyber tools is not absence of capability โ it is presence of operational security.
- GRU Unit 74455 (Sandworm): DOJ-indicted for NotPetya ($10B damage). Uses commercial hosting and VPNs โ the same providers in our corpus.
Source: [OSINT-LIB] Microsoft Digital Defense Report 2023, UN GGE ICT Cyber Norms 2021. [XREF] TI-2026-031 (Aceville series), TI-2026-034 (Israel series), GRU Sandworm Indictment (WDPA 2020).
The attribution framework โ state OR criminal โ is an analytical convenience. It is not a network reality. The honeypot cannot distinguish a Chinese state actor from a Chinese criminal because they use the same Aceville/Tencent cloud. It cannot distinguish a Russian GRU officer from a Russian cybercriminal because they use the same VPNs and commercial hosting. It cannot see Israeli state actors at all because they don't make mistakes visible to a honeypot.
This is not a failure of the honeypot. This is what convergence looks like from the wire.
Exhibit F: The 96% โ When Reporting Is Theater
๐ The Abuse Reporting System in Numbers
96% failure rate โ documented across the corpus (TI-2026-026O).
5 distinct failure modes against Chinese cloud ecosystem alone (TI-2026-031F).
Zero criminal prosecutions resulting from 48 dossiers of documented evidence.
34 months โ time between OFAC sanctioning Garantex and FBI seizure. Thirty-four months of sanctioned operation processing $100M+ in ransomware proceeds.
The system is not broken. It is working as designed โ for a network that no longer exists. The abuse reporting infrastructure was built for an internet of accountable, single-jurisdiction providers. That internet ended circa 2008.
๐ The uncomfortable question
Q: Does the 96% failure rate serve everyone?
A: Count the beneficiaries:
- โ Criminal operators โ impunity
- โ Intelligence agencies โ operational cover (if you shut down the bulletproof hosting, you shut down your own infrastructure)
- โ Hosting providers โ revenue from all traffic types (the good customers subsidize the report about the bad customers)
- โ Surveillance vendors โ delivery infrastructure for products (FinFly ISP needs an ISP that doesn't look too closely)
- โ Jurisdictional arbitrage specialists โ no enforcement pressure (Seychelles shells are never challenged because nobody has standing)
- โ Victims โ the only stakeholder that loses
The failure is stable because every stakeholder with the power to change it benefits from not changing it. The victims โ individuals whose credentials are stolen, hospitals hit with ransomware, journalists targeted with Pegasus โ have no seat at the infrastructure governance table.
The Convergence
Here is what 48 dossiers prove when you read them as a single document:
๐ Same Providers
M247 serves NordVPN users AND sanctions-evading geofeeds. 1337 Services runs Tor exits AND phishing relay AND darknet hosting. ColoCrossing hosts legitimate websites AND the worst abuse-scored IPs in the US. The providers do not distinguish because they have no legal obligation to distinguish and no financial incentive to distinguish.
๐ Same Jurisdictions
US, NL, DE, SG, SC. These five host: state intelligence operations (NSA, AIVD, BND), commercial surveillance platforms (NSO, FinFisher), bulletproof hosting (ColoCrossing, 1337, Aceville), financial crime infrastructure (Garantex, Tornado Cash), and disinformation operations (IRA troll farms, Spamouflage). Five jurisdictions. Five domains. One infrastructure.
๐ฐ Same Financial Rails
Ransomware proceeds โ mixer โ high-risk exchange โ fiat. Sanctions evasion โ shell company โ correspondent banking. Surveillance vendor payments โ Israeli MoD license โ Luxembourg PE fund. The financial infrastructure is as shared as the network infrastructure. The same formation agents in Seychelles create shells for ASN ownership AND for money laundering.
๐ก๏ธ Same Enforcement Failure
96% abuse report failure. 34-month gap between Garantex sanction and seizure. Zero prosecutions from 48 dossiers. Export controls that shape the market without reducing it. The enforcement apparatus is not underperforming โ it is structurally compromised by the convergence itself. Every enforcement action against cybercrime infrastructure disrupts intelligence operations. The system protects itself.
What This Means
If you've read this far, you understand something that most cybersecurity reports avoid saying: the internet's abuse infrastructure is not a malfunction. It is a feature.
The same infrastructure serves five masters โ cybercrime, surveillance, state operations, financial crime, and disinformation. Each master benefits from the others' existence because each provides cover for the others' traffic. The VPN that protects a journalist protects a criminal. The bulletproof hoster that resists takedowns for a state operation resists takedowns for a ransomware gang. The shell company that hides an intelligence front hides a money laundering ring.
The convergence is stable because every stakeholder with power benefits from the status quo. Criminals get impunity. Intelligence agencies get cover. Hosting providers get revenue. Surveillance vendors get delivery infrastructure. Regulators get complexity that justifies budgets. The only losers are the victims โ and victims don't attend RIPE meetings.
โ๏ธ The Evidence Room Verdict
Forty-eight dossiers document a system, not a list of incidents. The system has:
- 10 enabling entities โ registered companies, not shadow organizations
- 5 jurisdictions โ chosen for the combination of connectivity and impunity
- 3 documented tool-leak pipelines โ government โ commercial โ criminal, irreversible
- 1 financial architecture โ shared between cybercrime, sanctions evasion, and intelligence operations
- 96% enforcement failure โ structural, not accidental
This series (TI-2026-035B through 035B-L) will take each of these exhibits and break it open. The Surveillance Vendors (035B-B). The Epstein Infrastructure (035B-C). The Money Pipeline (035B-D). The State Actors (035B-E). The Surveillance Market (035B-F). The Jurisdictional Arbitrage Machine (035B-G). The Whistleblowers Knew (035B-H). The Critical Infrastructure Question (035B-I). The Disinformation Layer (035B-J). The Convergence (035B-K). The Questions That Remain (035B-L).
Eleven letters. Each sourced. Each cross-referenced. Each asking the questions that the evidence demands but the industry avoids.
The conspiracy is not hidden. It is published in DOJ indictments, EU Parliament reports, UN GGE documents, and WikiLeaks archives. The conspiracy is the system. And the system is operating on infrastructure you can ping.
Cross-Investigation Map
| Exhibit | Evidence Source | Cross-References |
|---|---|---|
| A. Five Jurisdictions | Infrastructure cross-tabulation (518 inv.) | 026 (Phantom ASN), 031 (Aceville), 032 (American Mirror), 027 (Corridors) |
| B. Ten Entities | Entity frequency analysis | 023 (M247/VPN), 030 (1337/Tor), 031 (Aceville/Tencent), 032 (ColoCrossing/Psychz) |
| C. Kill Chain Economy | 035A pipeline + FinCEN/Europol/CISA | 035A (Full Pipeline), 026O-GO (Go scanner), 019M (Cartographers) |
| D. Surveillance Pipeline | WikiLeaks Spy Files (1,063), Vault 7 (105) | 034 (Israel series), Google TAG 2024, Apple v NSO |
| E. State Actors | Microsoft, UN GGE, DOJ indictments | 031 (Aceville/Tencent), 034 (Israel), GRU Sandworm |
| F. 96% Failure | 026O abuse report analysis | 031F (Chinese cloud failures), 032 (American mirror failures) |
Methodology
This investigation uses four evidence tiers:
- [HONEYPOT] โ Direct observation: 8,000+ IPs, 271K+ entity links, SSH/Telnet/HTTP
- [CORPUS] โ Cross-investigation analysis: 518 investigations, 48 published dossiers in dossier_intel
- [OSINT-LIB] โ Primary-source documents: 4,692 NLP-enriched chunks from curated library
- [XREF] โ Direct cross-reference to specific published investigations
Every quantitative claim is sourced. Where sources disagree, the disagreement is noted. Implications tagged [DOCUMENTED] (directly stated in sources) or [INFERRED] (logical extension of documented facts). Confidence levels: HIGH (multi-source corroboration), MEDIUM (single authoritative source), LOW (pattern inference requiring further validation).
๐ Series Navigation โ Kill Chain Economy (TI-2026-035)
035A โ The Full Pipeline โ 035B โ The Evidence Room โ 035B-B through 035B-L โ forthcoming