🕳️ Transnational Repression theater

Tracks transnational repression: authoritarian states and mercenary-spyware vendors reaching across borders to surveil, silence, and coerce dissidents, journalists, and diaspora communities. It matters because commercial zero-click implants and coordinated online harassment now let regimes project domestic control worldwide against protected persons.

🏹 Threat Actors

🦠 Malware & Tools

🧭 Intelligence disciplines

📚 Priority sources & datasets

📜 Transnational Repression Playbook

1. Collect targeting artifacts from victim device forensics, phishing SMS/email lures, and spyware C2 domain registrations tied to known vendors
2. Fingerprint implants against Citizen Lab and Amnesty indicators, mapping domain infrastructure and TLS certificates to specific spyware families
3. Correlate victim selection with dissident, journalist, and diaspora cohorts to distinguish criminal from state-sponsored surveillance intent
4. Attribute operator to a client government via infrastructure clustering, procurement records, and vendor customer-country reporting
5. Brief affected individuals and civil-society partners with device-hardening guidance and preserve chain-of-custody forensic evidence
6. Refer confirmed vendors and operators for sanctions designation and export-control action, and publish IOCs to protect at-risk communities

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🎯 Add to case

🗃 Data Management

🧩 Advanced Capabilities

🔗 Cross-domain pivots