Acheron · Agentic research for the FT3 taxonomy
FT3 names how fraud works. Acheron finds what hasn't been named yet.
Acheron is a private, agent-driven research system built by Vincent Passaro. Its agents read fraud and threat intelligence, test each observed behavior against every technique in FT3, the public fraud tactics and techniques framework, and prepare evidence-backed proposals that FT3 maintainers review.
Why it exists
Analysts spend their week reading reports to find the one behavior the framework hasn't named yet.
Acheron does that reading overnight, so your team starts the morning deciding what to defend against.
How it works
How Acheron turns threat reporting into FT3 proposals
Four stages, each run by agents. The output is always a proposal, never a change to FT3.
01 · Extract behavior Behavior, not keywords.
Agents extract what the actor actually did: who acted, the action, the mechanism, and whether it was observed, reported, or only a capability. Every claim points to the source passage it came from, and inferences are labelled as inferences.
02 · Challenge the claims A second model tries to prove the first one wrong.
A separate reviewer, working from fresh context, hunts for omissions and unsupported assertions across the whole report. Claims that cannot point to a source passage are removed, and a recall check sends back behaviors the initial pass missed.
03 · Compare against FT3 Every observation meets every technique.
Each fraud observation is compared against every FT3 record, not a retrieved shortlist, so a familiar label cannot hide a different behavior and partial coverage can still add new evidence.
04 · Propose for review A candidate with its receipts attached.
Acheron drafts a new technique, an enrichment, or a revision in FT3's own language, with the source evidence attached, and files it for maintainers to decide. It never merges, promotes, or releases anything.
Agentic research
Agents did the reading. You make the call.
In this illustrative run, crawler agents pull four relevant items from an overnight feed. Agent A drafts findings from them, and Agent B checks each one against its source while A is still drafting. B rejects a claimed loss figure that one source contradicts, and a recall check sends back a behavior A missed. The verified findings become a proposed technique, compared against every FT3 technique, that waits for one human decision.
What it has produced
A fake wallet package FT3 had no name for.
Acheron's agents found a malicious npm package posing as a wallet brand to steal crypto wallets and credentials, and proposed it as a new FT3 behavior.
It came from one pilot run: 21 fraud behaviors checked against all 263 FT3 techniques, 13 proposals filed, six of them new behaviors. All 13 are waiting on FT3's maintainers.
Questions about Acheron
What is Acheron?
Acheron is a private, agent-driven research system built by Vincent Passaro. It reads fraud and threat intelligence, extracts the behaviors actors actually used, compares each one against every technique in FT3, and prepares evidence-backed proposals for new techniques or improvements that FT3 maintainers review.
How does Acheron find new fraud techniques?
Agents extract source-grounded behaviors from reporting. A second model challenges every claim and removes anything without a source passage, and a recall check recovers behaviors the initial pass missed. Each remaining observation is compared against every FT3 technique, and behaviors no technique covers become candidate proposals.
Does a human review Acheron's output?
Yes. The research is agent-driven; the decision is not. Acheron does not author FT3 records, merge changes, or make taxonomy decisions. Every proposal stays a candidate until FT3 maintainers decide what becomes framework knowledge.
How is Acheron related to FT3?
FT3 is a public framework of fraud tactics and techniques, often described as MITRE ATT&CK for fraud. Acheron is a separate, private research system that proposes additions and improvements to FT3. It does not change the framework itself.
Has Acheron added techniques to FT3?
Not yet. Its pilot filed 13 reviewed proposals into FT3's intake queue, six of them proposed new behaviors. As of November 2026 none has been decided; each waits for FT3 maintainers.
Can I use Acheron?
No. Acheron is private and used only by FT3's maintainers, who review every proposal it files. If you want to know how it works, get in touch.