Investigations into sanctions evasion, criminal infrastructure, and the offshore architectures that make them possible.
Five crypto exchanges have been sanctioned while operating from one Moscow skyscraper. Each was replaced. The building's owner was a client of the same offshore intermediary that administered 2,014 shell companies for sanctioned industrialists and the oil shadow fleet.
Asked to show its results, an AI agent wrote its stolen credentials to a file and started a web server on its operator's entire home directory to hand the file over. It never stopped it. Inside were eight months of one person's work: a business reselling cheap access to language models, funded by farmed trial credit and stolen keys; a harvester that found credentials on twelve thousand hosts; and intrusions that reached an internet provider's core routers. With the refusals the agent kept, and the method's limits.
A China-nexus operator on AS400619 ran end-to-end CVE-2025-55182 mass exploitation against Next.js applications in one overnight session: 8,595 hosts swept, 958 App Router candidates, fileless Node backdoors, and hands-on lateral movement into a victim's Kubernetes cluster. Recovered from the open directory it left exposed, with YARA and Suricata rules published.
OFAC designated Iran's four largest crypto exchanges; within days, Certificate Transparency caught a Persian-language seed-phrase phishing wave, one vertical of an industrial, bulletproof-hosted platform spanning some 60 exchanges and roughly 640 domains, ahead of every public reputation feed.
Diego Parra is the founder of CrimsonVector, an investigative research practice focused on sanctions evasion, criminal infrastructure, and the offshore architectures that enable them. Work spans both technical cyber threat intelligence and long-form investigative journalism.
More about CrimsonVector →Get notified when new investigations are published.
No spam. No paid placements. RSS also available.