Analyst-maintained profiles of ransomware and cybercriminal operations, built on sourced, tiered intelligence with explicit confidence ratings. Every claim is tagged by type, source, and confidence level. Confirmed facts are kept separate from what an actor claims about itself. Attribution disputes are surfaced, not papered over.
These profiles are authored and maintained by Jon DiMaggio. AI tooling is used in the research and drafting workflow. All analytical judgments, source evaluation, and confidence ratings are the analyst's. Research methodology, AI use, and research-tool relationships are disclosed in the methodology section below.
Research supporting these profiles uses Flare for threat intelligence and dark-web research and Authentic8 Silo for secure research browsing. Arkem Cyber is a client of Flare, Jon DiMaggio participates in the Flare Fellow program, and Flare provides complimentary platform access. Authentic8 provides complimentary access to Silo for research use. No vendor reviewed, approved, or had advance access to these profiles prior to publication. Vendor tooling informs collection, not analytical conclusions.
Every claim in a profile carries a structured tag identifying its type, source, and confidence level. Type is F (fact), A (assessment), or C (actor claim). The distinction matters: what CL0P says about itself is not treated the same as what CISA confirms about CL0P.
Confidence levels
Source tiers
Profiles carry an overall confidence rating. A profile rated Moderate means the historical record is well-sourced but at least one significant axis (attribution, current campaign ownership, or victim confirmation) remains contested or unverified. Profiles are updated when new developments warrant it; the last-updated date on each entry reflects the most recent revision.
Research tooling and relationships (expanded)
Research for these profiles uses Flare for dark-web and threat intelligence monitoring and Authentic8 Silo for secure research browsing. Arkem Cyber maintains a client relationship with Flare. Jon DiMaggio participates in the Flare Fellow program, and Flare provides complimentary platform access for research use. Authentic8 provides complimentary access to Silo for research use. Where Flare or Silo data supports a specific finding, the tool is recorded in that profile's Sources section at the claim level, the same way any other source is cited.
No vendor reviewed, approved, or had advance access to these profiles prior to publication. Vendor tooling informs collection, not analytical conclusions. These relationships do not determine profile findings, sourcing, or analytical judgments.
AI-assisted workflow
These profiles are analyst-authored. AI tooling is used in the research, source review, drafting, and quality-control workflow. All source evaluation, analytical judgments, attribution decisions, and confidence ratings are the analyst's.
Additional profiles are in development. Profiles are published when the sourcing meets the standard described in the methodology, not on a schedule.
Arkem Cyber is a boutique cybercrime intelligence advisory firm specializing in threat intelligence, adversary research, and investigative support. If your organization needs help understanding a specific threat, actor, or campaign, start a conversation.