Infrastructure Destruction Squad / BLACKNET-00: Ransomware, Firebase and ICS Tooling

*Executive Summary:* Infrastructure Destruction Squad / BLACKNET-00 is a low-maturity but operationally relevant threat cluster: their publicly released ransomware builder generates payloads that encrypt files, persist, and display ransom UIs (though encryption is a recoverable repeating-XOR with the key exposed), Shadow Ghost reliably enumerates exposed Firebase Storage/Firestore/Realtime DBs, and TRK-25 contains credible ICS/SCADA discovery and fingerprinting logic that could feed CNI targeting; actor claims (including DDoS and CNI impacts) are frequently inflated and should be verified before escalation.