Takedowns pushed fraud buyers into smaller specialised shops, Rapid7 says

The sequence in Rapid7's post reads like a purchase order. A novice looks for instructional manuals first, on forums or on Styx ^[10]. With a scheme picked, the same buyer goes back to the shops for infrastructure and credentials ^[11]. Figure 1 in the post is an advertisement for an infostealer with special detection for financial accounts ^[12].

Rapid7 ties the surge in emerging threat actors to rising victim counts and stolen financial resources ^[18]. The shops keep that supply moving by selling the starter kit, including server infrastructure and targeted lists ^[5].

MITRE's framework is the thinnest part of the write-up. Rapid7 wrote that MITRE "has been taking a positive step towards standardizing the fight against fraud, while helping organizations target the relevant directions to look at" ^[7]. The description stops at purpose. No technique ID appears anywhere in the post, and Rapid7 makes no claim that F3 is the first framework of its kind ^[16].

Four storefronts are named in total ^[14]. None of the dismantled marketplaces is named, no takedown date is given, and no buyer volumes are counted ^[15]. The damage figure is an anticipation of fraud losses approaching hundreds of billions of US dollars, with no method attached ^[9].

That leaves the fragmentation claim resting on what a fraud analyst sees in the shops rather than on measured volume ^[1]. It is still the useful part. A defender who has been watching two or three big marketplaces is watching the wrong inventory, because the goods now sit behind social media accounts and niche storefronts ^[1]. F3 is worth reading for the same reason ATT&CK was in 2015: it gives the people who do this work a shared set of labels to argue budget with ^[6].