Understand the operation behind the attack.
Investigate cybercrime and nation-state threats using natural language. Connect threat reporting, technical indicators, and financial intelligence to understand campaigns and produce reports your team can use.
Problem
Fragmented intelligence slows cyber investigations.
Evidence is scattered across sources.
Threat reporting, infrastructure records, and financial activity sit in separate tools. Analysts spend time collecting evidence before they can assess a cybercriminal or nation-state campaign.
Related attacks are investigated separately.
Shared infrastructure, tooling, and services can connect incidents across organizations. A single report rarely shows the wider operation.
Manual research delays the next decision.
Analysts repeat searches and reconcile findings across tools, then turn the evidence into reports for investigators, defenders, and leadership.
93
New ransomware variants
Observed in 2025, a 94% increase from 2024.
Source: TRM Labs · New Disruption Opportunities in the Evolving Ransomware Ecosystem
51%
Off-ramp concentration
Share of ransomware off-ramp volume handled by five services in 2025.
What is Ardence?
Ardence is an AI investigation platform built for all-source intelligence. Ask questions in natural language, with support for multiple languages. Cyber workflows built with experienced CTI analysts guide research across sources and help teams produce consistent, source-backed assessments.
How it works
Build a clearer picture of the threat.
Research
Ask, "What ransomware attacks have targeted the UK in the past six months?" Ardence uses relevant reporting and infrastructure intelligence to compare campaigns and prepare a source-backed summary.
- Define the threat, geography, and period in natural language
- Compare reported attacks, infrastructure, and campaign patterns
- Generate a summary with sources and gaps for analyst review
Connect
Start with an incident report or domain. Compare hosting, registration, malware, and breach records to identify related activity. Document the connections and uncertainty in a campaign assessment.
- Enrich domains, IPs, certificates, hashes, and handles
- Compare shared infrastructure and tooling with known campaigns
- Prepare a campaign assessment with the evidence for each connection
Trace
Start with a ransom wallet or stolen-funds transaction. Use blockchain intelligence to trace transfers and identify receiving services, then prepare a financial summary alongside the technical findings.
- Trace on-chain transfers and identify receiving wallets and services
- Compare financial connections with the campaign evidence
- Document transaction paths and receiving venues for further investigation
Report
Ask for a technical summary, executive briefing, or report on the week's activity. Review the findings and supporting sources, and share only material permitted under each source's use and disclosure restrictions.
- Choose the audience, scope, and reporting period
- Separate observed facts from assessments and unanswered questions
- Review the report before sharing it or taking operational action
Research
Ask, "What ransomware attacks have targeted the UK in the past six months?" Ardence uses relevant reporting and infrastructure intelligence to compare campaigns and prepare a source-backed summary.
- Define the threat, geography, and period in natural language
- Compare reported attacks, infrastructure, and campaign patterns
- Generate a summary with sources and gaps for analyst review
Connect
Start with an incident report or domain. Compare hosting, registration, malware, and breach records to identify related activity. Document the connections and uncertainty in a campaign assessment.
- Enrich domains, IPs, certificates, hashes, and handles
- Compare shared infrastructure and tooling with known campaigns
- Prepare a campaign assessment with the evidence for each connection
Trace
Start with a ransom wallet or stolen-funds transaction. Use blockchain intelligence to trace transfers and identify receiving services, then prepare a financial summary alongside the technical findings.
- Trace on-chain transfers and identify receiving wallets and services
- Compare financial connections with the campaign evidence
- Document transaction paths and receiving venues for further investigation
Report
Ask for a technical summary, executive briefing, or report on the week's activity. Review the findings and supporting sources, and share only material permitted under each source's use and disclosure restrictions.
- Choose the audience, scope, and reporting period
- Separate observed facts from assessments and unanswered questions
- Review the report before sharing it or taking operational action
Intelligence
Intelligence built for cyber investigations.
Cyber threat intelligence
Connect reporting with the activity behind it.
Compare reporting on cybercriminal and nation-state campaigns with domains, hosting records, malware, and breach data. Build an assessment with the evidence behind each connection.
Blockchain intelligence
Follow the financial activity behind the attack.
Trace ransom payments and stolen digital assets to receiving wallets and services. Connect the financial findings with technical evidence; reports shared through Chainabuse can provide further leads.
All-source intelligence
Dozens of data partners. One investigation platform.
Ardence brings intelligence from TRM and specialized data providers into one investigation under a single Ardence contract.¹
Ask once, and Ardence selects relevant sources for the investigation. Use Ardence to analyse domain, hosting, breach and identity records in the context of your research question or alongside incident evidence. Commercial partner intelligence and open-source information support that analysis, subject to each source's permitted-use and disclosure restrictions.
¹ Provider availability varies by customer and jurisdiction. Supplemental terms may apply.
Services
Expert support and training for cyber investigators.
- Learn more
Investigative support
Work with TRM specialists to investigate ransom payments, stolen funds, and the services receiving them. Connect that financial evidence with your team's technical findings and prepare the next investigative step.
- Learn more
TRM Academy
Build skills in tracing digital assets and interpreting the financial evidence in cybercrime cases through TRM training, courses, and certifications.
Community
Coordinate action against cybercrime services.
- Learn more
Resolve: Cyber Threat Intelligence
Get hands-on training and connect with fellow investigators at Resolve: Cyber Threat Intelligence, a dedicated mission track focused on the challenges your team faces.
Disruption Sprints
Recurring events that bring investigators and partners together to work live cases and carry out coordinated disruptions against cybercrime networks and the services that support them.
Questions
FAQ
Start with a natural-language research question about a threat, sector, region, or period. You can also begin with a domain, IP address, file hash, wallet, transaction, or incident report. Ardence supports questions in multiple languages and selects relevant sources for the investigation.
Ardence brings blockchain intelligence from Forensics into a broader investigation alongside other evidence. Forensics provides deeper crypto tracing when ransom payments, stolen funds, or other digital-asset activity are relevant. Investigations can also proceed without a financial trail.
Generate a campaign report, technical summary, executive briefing, or report covering the week's activity. Your analyst reviews the supporting sources, reasoning, and uncertainty before sharing findings or taking action. Share only material permitted under each source's use and disclosure restrictions. Attribution is one possible assessment; it is not required to understand a campaign or inform a response.
Cyber Attacks and Cybercrime focuses on understanding attacks, campaigns, and the operations behind them. Cyber Resilience assesses which threats affect an organization and what defenders should prioritize. Both support proactive research into cybercriminal and nation-state activity.
No. TRM helps teams identify, trace, and document fund movements and can support alerts to institutions. Exchanges, stablecoin issuers, courts, and law enforcement make freezing, seizure, and recovery decisions.
Insights
Insights on cyber attacks and cybercrime.
New Disruption Opportunities in the Evolving Ransomware Ecosystem
TRM Insights on ransomware payments, new variants, laundering methods, and service concentration.
International operation dismantles EUR 336 million ransomware laundering pipeline AudiA6
How TRM traced a shared off-ramp used by twenty ransomware groups.
2026 Crypto Crime Report
Insights on hacks, exploits, ransomware variants, and nation-state theft with methodology notes.
Cyber Threat Intelligence (CTI)
A practical introduction to cyber threat intelligence, its sources, and how teams use it.
