Act I: What One SSH Probe Is Worth

Our honeypot captures an SSH login attempt. Username: root. Password: admin123. The probe comes from an IP in AS210558 (1337 Services GmbH, documented in 8 investigations). It takes 0.3 seconds.

That 0.3 seconds is the first tick of a financial clock.

From $0.003 to $4.5 million. A leverage ratio of 1:1,500,000 at the extreme — and 1:44 on average (035A calculation). No legitimate financial instrument in history has offered this return. Venture capital averages 1:3 over a decade. Drug trafficking averages 1:10. Ransomware offers 1:44 in weeks.

And the starting capital? Hosting. A VPS at 1337 Services costs €5/month. A botnet of 1,000 compromised devices costs $200-500 to rent. The barrier to entry is lower than a food truck.

Act II: The Rails — How Dirty Money Moves

Four rails. Each designed to do one thing: convert a traceable blockchain transaction into an untraceable one. And each operates in — or routes through — the same jurisdictions documented across our corpus.

Garantex operated from Moscow, serving ransomware operators, darknet markets, and sanctions evaders simultaneously. OFAC sanctioned it in April 2022. It continued operating for thirty-four months before the FBI seized it in February 2025. During those 34 months, it processed an estimated $100M+ in criminal proceeds — sanctioned, documented, public knowledge, still operating.

Act III: The Formation Agents — Same Lawyers, Different Clients

Here is the finding that connects this investigation to everything before it:

The Treasury is describing — in the context of nuclear proliferation financing — the exact same shell company pattern documented in our ASN ownership investigations. Word for word. "Multiple front or shell companies in the United States and third-country jurisdictions." Replace "proliferation networks" with "bulletproof hosting providers" and the sentence is still true. Replace with "ransomware laundering operations" and it's still true. Replace with "intelligence fronts" and it's still true.

The architecture is a service. The formation agents don't sell shells for a specific purpose. They sell opacity. The client brings their own purpose. The shell is the container. The purpose is the content. The container doesn't care about the content.

Act IV: The Circular Economy

In 035A we showed the kill chain as linear. It isn't. The money comes back.

The cycle:

1. Ransomware proceeds (BTC/XMR) → mixer → exchange → fiat
2. Fiat → new hosting infrastructure (Aeza, 1337, bulletproof VPS)
3. New hosting → new scanning campaigns → new credentials
4. New credentials → new ransomware deployments → new proceeds
5. Return to step 1

The economy is self-financing. It does not require external capital. It does not require bank loans. It does not require investors. The initial investment — a €5/month VPS — generates returns that fund expansion. The economy grows from its own revenue. And the revenue cycle time is weeks, not years.

This is why enforcement against individual actors fails. Arrest a ransomware operator — their affiliate replaces them. Sanction an exchange — Grinex emerges within weeks. Seize a hosting provider — the customer migrates to another provider with the same cryptocurrency they earned last month. The economy regenerates because the capital is never extracted. It circulates within the system.

Act V: The Insurance Industry's Dirty Secret

Read that quote from FinCEN — the US government's own financial crimes enforcement network. DFIR companies and cyber insurance carriers directly facilitate ransomware payments.

This means: when a hospital is hit with ransomware, the insurance company pays a "ransom negotiation firm" (DFIR company), which communicates with the attacker, purchases cryptocurrency, and transfers the ransom. The insurance company writes it off as a claim. The DFIR firm takes a fee. The ransomware operator receives payment through a professionally managed financial pipeline operated by legitimate, regulated, insured companies.

The cybersecurity industry is not just fighting ransomware. A measurable portion of it is financing ransomware.

Act VI: Sanctions as Documentation, Not Enforcement

The pattern is clear: sanctions work when the entity is in a cooperative jurisdiction (BTC-e seized in Greece, Suex in Czech Republic). Sanctions fail when the entity is in a hostile jurisdiction (Garantex in Russia — 34-month gap) or when the target is a protocol, not an entity (Tornado Cash — cannot be seized because it has no servers to seize).

The parallel to abuse reporting is exact:

Both systems share the same failure mode: they were designed for a world of accountable, locatable, cooperative entities. That world no longer exists. The entities are in hostile jurisdictions. The infrastructure is decentralized. The enforcement tool (report/sanction) is faster than the enforcement action (takedown/seizure) by months or years. During the gap, the criminal operation continues — documented but unimpeded.

Act VII: The $20 Billion Number

Twenty billion dollars. That's the documented floor — the amount that blockchain analysis companies can trace. The actual number is higher because: privacy coins (Monero) are untraceable by design, peer-to-peer transactions avoid exchanges entirely, and not all illicit transactions are identified as illicit.

For context: $20.1 billion is larger than the GDP of 80+ countries. It is larger than the defense budgets of most NATO members. It is generated by an economy whose entry cost is a €5/month VPS and whose supply chain starts with the SSH probes our honeypot captures.

And 44% of it — $8.8 billion — flowed to entities the US government had already sanctioned. Sanctioned. Documented. Named. Published in the Federal Register. And still receiving $8.8 billion per year.

Cross-Investigation Map

Methodology

• [OSINT-LIB] — 732 financial-domain library chunks: FinCEN (249), Crypto Forensics (103), Money Laundering (179), Ransomware Economics (101), Sanctions (200). All primary-source government/regulatory documents.
• [HONEYPOT] — SSH probe economics: cost-per-attempt calculation from honeypot observation + documented pricing data
• [XREF] — Cross-reference to 035A (pipeline), 019M (RDP.sh), 026 (shell companies), 027 (corridors)
• [FINANCIAL] — OFAC SDN entries, FinCEN SARs, Chainalysis blockchain analytics