Investigations into sanctions evasion, criminal infrastructure, and the offshore architectures that make them possible.
Five crypto exchanges have been sanctioned while operating from one Moscow skyscraper. Each was replaced. The building's owner was a client of the same offshore intermediary that administered 2,014 shell companies for sanctioned industrialists and the oil shadow fleet.
OFAC designated Iran's four largest crypto exchanges; within days, Certificate Transparency caught a Persian-language seed-phrase phishing wave, one vertical of an industrial, bulletproof-hosted platform spanning some 60 exchanges and roughly 640 domains, ahead of every public reputation feed.
A free "VPN for Russian soldiers" is in fact Android spyware. We ran it in a sealed lab, followed it to a still-live, undetected C2, and mapped the APEX RENT phishing-as-a-service business and the bulletproof host behind it.
A pre-kickoff census of the FIFA World Cup 2026 impersonation surge: the GHOST STADIUM phishing operation, a Hong Kong betting backbone, and an ecosystem that absorbed four advisories and kept growing.
Diego Parra is the founder of CrimsonVector, an investigative research practice focused on sanctions evasion, criminal infrastructure, and the offshore architectures that enable them. Work spans both technical cyber threat intelligence and long-form investigative journalism.
More about CrimsonVector →Get notified when new investigations are published.
No spam. No paid placements. RSS also available.