Shadow Council

A Windows 10 workstation was seized from someone going by "d4ag0n," suspected of running ransomware operations. Law enforcement pulled a triage image. The brief says the suspect coordinated with affiliates and kept a ledger of ransom payments somewhere off the machine.