Insights

Analytical Assessment

Key judgments, estimative language, competing hypotheses, collection gaps, and forward indicators for BlackRock, Inc.. All confidence assignments follow ODNI ICD 203; ICD estimative language is italicised throughout.

Total Judgments: 11
High Confidence: 5
Moderate Confidence: 6
Low Confidence: 0
Techniques Applied: KAC ACH Premortem Red Hat

§ 01

Estimative Language Spectrum

ODNI ICD 203 · probability of being true

remote <5%

unlikely <20%

possibly 20–55%

roughly even chance ~50%

likely 55–80%

very likely >80%

almost certainly >95%

KJ-01 KJ-02 KJ-03 KJ-04 KJ-05 KJ-06 KJ-07 KJ-08 KJ-09 KJ-10 KJ-11

High Moderate Low Markers are positioned by ICD estimative language, not raw confidence tier

§ 02

Key Judgments

11 judgments · full reasoning + alternatives

KJ-01 High Confidence very likely >80%

Strong core, uneven periphery — H2 leads after ACH

Statement · including alternatives considered

BlackRock's security posture is very likely uneven: hardened on the core blackrock.com surface and Aladdin client tenants, but materially weaker on peripheral brand and country-code domains (notably ishares.nl and the iunits.com/gachallenge.com expiry cluster). H2 (uneven posture) is the leading ACH hypothesis over H1 (uniformly mature) because A1/A2-grade evidence shows specific peripheral gaps that a uniformly mature program would not exhibit.

Analytical reasoning

ACH scoring favors H2 (uneven posture) over H1 (uniformly mature) and H3 (systemic gaps). Indicators of a hardened core: separate Okta tenants for corporate, Aladdin US, and Aladdin EMEA with US/EU cluster split (ev_013–ev_015); active HackerOne bug-bounty program (ev_076); DNSSEC enabled across most .com portfolio domains; all four registry locks on blackrock.com. Indicators of peripheral gaps: ishares.nl has no SPF, DMARC p=none, and no DNSSEC (ev_106, ev_120); blackrock.com itself has no CAA records (ev_116) and SPF ~all SoftFail with DMARC p=quarantine (ev_117), each a step short of the strict -all/p=reject posture seen on FutureAdvisor (ev_006) and alts-iq.com (ev_041); MDN Observatory F (5/10) on the marketing surface (ev_062). The leading interpretation is very likely; H1 is unlikely, H3 very unlikely.

KJ-02 High Confidence very likely >80%

27-32 day domain-expiry cluster: iunits.com + gachallenge.com

Statement · including alternatives considered

Two BlackRock-affiliated brand domains, iunits.com (expires 2026-07-12) and gachallenge.com (expires 2026-07-17), are very likely exposed to hostile registration within a concentrated 5-day window 27-32 days after the investigation. iunits.com has no DNSSEC, amplifying the impersonation surface if the domain briefly lapses.

Analytical reasoning

RDAP records (ev_105, ev_103) confirm iunits.com expiry 2026-07-12 and gachallenge.com expiry 2026-07-17 — a 5-day concentrated window starting 27 days after investigation. iunits.com is the oldest BlackRock-affiliated domain (registered 1999-07-12) and is the only surfaced domain in the portfolio without DNSSEC enabled. CSC auto-renewal is the standard control, but a single billing lapse, portal-credential compromise, or registrar outage would very likely result in temporary availability for hostile registration. The iUnits brand is investor-facing in the Canadian ETF context — a hostile registrant could weaponize it for phishing campaigns against Canadian retail/institutional investors. Confidence is high; the expiry dates are cryptographically attestable via RDAP and the absence of renewal would be observable.

KJ-03 High Confidence very likely >80%

ishares.nl is fully email-spoofable — sole exception in the portfolio

Statement · including alternatives considered

ishares.nl is very likely exploitable for email-based brand impersonation against Dutch iShares investors. The domain has no SPF record, DMARC policy is p=none (monitoring only), and DNSSEC is not enabled — three layers of email-authentication that all other surfaced BlackRock domains have implemented.

Analytical reasoning

SIDN RDAP (ev_007) confirms BlackRock, Inc. as registrant and DNRAdmin@Blackrock.com as both admin and tech contact. DNS mail-auth (ev_106) shows no SPF record published, DMARC v=DMARC1; p=none; rua=mailto:dmarc_agg@vali.email (monitoring only, zero enforcement), and delegationSigned: false (no DNSSEC). By contrast, futureadvisor.net (ev_043), alts-iq.com (ev_041, ev_091), and the blackrock.com cluster (ev_117) all run p=reject or stricter. The configuration drift makes ishares.nl very likely the highest-yield brand-impersonation pivot in the BlackRock surface for adversaries targeting Dutch investors. Confidence is high — the configuration is observable from multiple DNS queries and contradicts no other evidence.

KJ-04 High Confidence very likely >80%

Aladdin client roster substantially leaked via CT logs

Statement · including alternatives considered

BlackRock's Aladdin institutional-client tenant list is very likely substantially exposed through Certificate Transparency logs, surfacing at least 28 named-client portals (BNY Mellon IM, Charles Schwab, BNP Paribas AM, UniCredit, Schroders, Swiss Re, Principal, Janus Henderson, Manulife, EFG International, Intesa Sanpaolo, BPER, Sumitomo Mitsui AM, Sumitomo Mitsui Trust AM, Helvetia, Morgan Stanley Wealth, Coppel, Poste Italiane, EquiTrust, PFA Pension, Pension Insurance Corp, GMO LLC, Delaware Life, IFM Investors, Future Fund, Thrivent, SVB) plus likely-named candidates (BAML, BIS).

Analytical reasoning

certspotter enumeration (ev_004, ev_034) returned 189 unique SANs across 100 certs, including ~28 named-client tenant subdomains under *.blackrock.com. None resolve externally (ev_056 confirms NXDOMAIN as representative), but the names alone constitute a confidential customer disclosure. The baml.login.blackrock.com EV cert (ev_089) — issued by DigiCert EV RSA CA G2, distinct from the standard portfolio CA — likely reflects a BAML/Bank of America Merrill Lynch SSO partnership. The exposure does not enable direct compromise of Aladdin, but very likely enables targeted spear-phishing pretexts (e.g., pretending to be BlackRock support contacting an Aladdin admin at a named client). Confidence is high; the CT log evidence is cryptographic and unambiguous.

KJ-05 Moderate Confidence very likely >80%

Internal supply-chain inventory enumerable via CT — reachability not testable

Statement · including alternatives considered

BlackRock's internal software-supply-chain inventory is very likely substantial and largely shielded behind DNS-NXDOMAIN, but is enumerable through CT logs (Harbor container clusters EWD and HAL with admin and preprod variants, JFrog Artifactory, an active Subversion server, dev/admin portals, Azure DMZ wildcard, FIT environments, internal codenames). Reachability is gated by VPN/network controls that this passive recon cannot test.

Analytical reasoning

Certificate Transparency surfaces two Harbor container-registry clusters (EWD and HAL, with admin and preprod variants), JFrog Artifactory, an active SVN server, Azure DMZ wildcards (*.extdns.azblkdmz.blackrock.com), FIT zones (BLZ, TSZ), and internal codenames (torpedo). All return NXDOMAIN externally (ev_016, ev_017, ev_020, ev_044, ev_052). The names alone very likely facilitate targeted attacks once an adversary obtains an initial foothold (VPN credential, employee endpoint), but the passive Corvus methodology cannot test whether VPN/IP-allowlisting controls are in place. Confidence is moderate because the surface is enumerable but the exploitability depends on unobserved controls. H1 (mature posture, intentional NXDOMAIN gating) and H2 (mature core) are both consistent with this evidence; H3 (systemic gaps) is inconsistent absent independent reachability data.

KJ-06 Moderate Confidence very likely >80%

Single registrar credential gates the entire domain portfolio

Statement · including alternatives considered

DNRAdmin@Blackrock.com is very likely the single CSC registrar-portal credential controlling the entire BlackRock domain portfolio. Compromise of this account would likely enable silent NS, DNSSEC, or transfer-lock modification across blackrock.com, futureadvisor.net, ishares.* TLDs, mgpa.com, impactinvesting.com, alts-iq.com, gachallenge.com, glscchart.com, and the iUnits / chart marketing cluster.

Analytical reasoning

RDAP across the portfolio (ev_005, ev_006, ev_037, ev_082, ev_090, ev_096, ev_097, ev_102, ev_103, ev_104, ev_105, ev_107) consistently lists DNRAdmin@Blackrock.com as the admin/tech contact and CSC Corporate Domains (IANA 299) as registrar. Codex-baseline reference (ev_121) flags this as the CSC portal credential. While blackrock.com carries all four registry locks (transfer/delete/update prohibited at both client and server), an admin who has authenticated to CSC's portal can likely request locks be removed. Confidence is moderate — the credential's existence is confirmed but its specific authentication posture (MFA, IP allowlisting, hardware-key requirements) is not observable from passive recon. KAC: this judgment assumes BlackRock does not segregate portal access across multiple admins; if shared-account discipline is loose, exposure grows.

KJ-07 High Confidence likely 55–80%

Broad SaaS stack — 30+ vendors anchored in DNS TXT verifications

Statement · including alternatives considered

BlackRock's SaaS attack surface is likely concentrated across 30+ named third-party vendors with active domain verifications, including the LLM stack (OpenAI Enterprise and Anthropic Claude both verified), identity (Okta x3 tenants, Duo SSO x2, LastPass), collaboration (Atlassian 6+, Salesforce x2, Microsoft 365, Slack, Zoom x2, DocuSign x2, Miro x2, Figma, Confluence), engineering (Gitpod, JFrog, Harbor, Postman, MongoDB, Censys, HackerOne), and operational tooling (Jamf MDM, OneTrust, Drift, Intercom, Lutron, Zapier, IBM Cloud).

Analytical reasoning

DNS TXT enumeration (ev_002, ev_032, ev_060, ev_066, ev_113) of blackrock.com surfaces 44+ vendor-verification tokens across 30+ products. The dual LLM verifications (openai-domain-verification and anthropic-domain-verification-p2md8z) confirm enterprise LLM workflows on both major frontier-model vendors. Three Okta tenants (corporate, Aladdin US, Aladdin EMEA) plus two Duo SSO tenants suggest authentication-stack segmentation. The 6+ Atlassian tokens likely reflect distinct Jira/Confluence instances per business unit. Active HackerOne (ev_076) gives a structured channel for vulnerability disclosure. Each vendor is a separate supply-chain pivot; the breadth materially raises third-party risk-management overhead and the probability that any one vendor's breach has BlackRock blast radius.

KJ-08 Moderate Confidence likely 55–80%

15,910 emails on file; `accept_all` domain — high spear-phish surface

Statement · including alternatives considered

The Hunter.io domain inventory reports 15,910 mailboxes at blackrock.com with accept_all=true and the firstname.lastname@blackrock.com pattern confirmed; this likely enables both targeted spear-phishing using the surfaced employee list and broad credential-stuffing attempts against the Okta SSO portals.

Analytical reasoning

Hunter (ev_022, ev_051) reports 15,910 emails on the domain with the pattern {first}.{last}@blackrock.com and accept_all=true (catch-all configured). Department-scoped queries (ev_087: 2,755 IT mailboxes; ev_098: 3,112 executive mailboxes) confirm the pattern across the org. Combined with the corporate login.blackrock.com Okta endpoint and the Aladdin SSO portals, the surface likely supports both targeted spear-phishing (using the named employees Hunter returned) and broad credential-stuffing against Okta. Confidence is moderate — Hunter's sample of 10-23 returned mailboxes is a tiny fraction of 15,910 and the broader list is not in evidence; the surfaced names are concrete spear-phish targets but the rest of the population is inferred from pattern.

KJ-09 Moderate Confidence unlikely <20%

No CAA records on blackrock.com — rogue-cert defense layer absent

Statement · including alternatives considered

blackrock.com publishes no DNS CAA records, so any globally trusted CA can issue a certificate for the apex or any subdomain without a CAA challenge. This is unlikely to be exploitable absent a separate CA compromise or mis-issuance, but the missing control removes one defense-in-depth layer against rogue-cert attacks.

Analytical reasoning

DNS CAA query for blackrock.com returned NODATA (ev_116, ev_002) — no CAA records published. The Authority SOA confirms the zone exists; the absence is a configuration gap, not a query failure. Under CA/Browser Forum baseline, any trusted CA may issue a cert without a CAA check, removing one defense-in-depth control against rogue issuance. The risk is unlikely to materialize absent a separate CA compromise, but likely warrants a fix given that all four registry locks and DNSSEC are already deployed — CAA is the smaller, easier complementary control.

KJ-10 Moderate Confidence likely 55–80%

Analyst-knowledge fields carry an Aug 2025 cutoff

Statement · including alternatives considered

Parts of this report rest on analyst training knowledge with an August 2025 cutoff (leadership roster, AUM figures, M&A deal values, named personnel). These details are likely still accurate as of the investigation date but cannot be cryptographically verified from the passive evidence base, so confidence on personnel-specific claims should be calibrated lower than confidence on cryptographically-attestable infrastructure claims.

Analytical reasoning

The leadership section (ent_151–ent_160), the 2024 acquisition narratives (ent_162, ent_163, ent_164, ent_210), and several technology entities (Aladdin profile, iShares profile) draw on analyst training knowledge with a stated cutoff of August 2025 (ev_024, ev_064, ev_067–ev_075, ev_077). These claims are likely still accurate at the investigation date (2026-06-15) — public-company executive rosters and announced M&A close dates are stable on this timeframe — but they are not cryptographically attestable from the passive evidence base. Premortem: if Salim Ramji (ent_160) departed BlackRock in 2024, the recon entity is stale-but-not-wrong; if any of the 2024-announced deals failed to close, the narrative would need correction. KAC tagged this as MOD-sensitivity + MOD-confidence; the dependent judgments (kj_004's BAML cert framing, anything personnel-dependent) carry the calibration.

KJ-11 Moderate Confidence roughly even chance ~50%

Press/breach-corpus dimension under-collected (Brave quota hit)

Statement · including alternatives considered

Brave web search quota was exhausted (HTTP 402 USAGE_LIMIT_EXCEEDED) during recon, leaving the press / news / leak-aggregator dimensions roughly even chance under-collected. Specifically, the report cannot verify whether DNRAdmin@Blackrock.com appears in breach corpora, whether any Aladdin client portals have surfaced in pastes, or whether ishares.nl has been used in observed phishing campaigns.

Analytical reasoning

Evidence ev_110 records that all 10 brave_web_search calls returned HTTP 402 USAGE_LIMIT_EXCEEDED. The Codex-baseline pivot ev_121 explicitly queues a check on DNRAdmin@Blackrock.com against HaveIBeenPwned / DarkNet dumps that did not execute this wave. The collection gap is roughly even chance material — leak-corpus exposure of DNRAdmin would materially change kj_006's confidence. Premortem-relevant: a future recon pass with the breach dimension funded should re-test the kj_006 surface.

§ 03

ACH — Competing Hypotheses

Analysis of Competing Hypotheses · leading hypothesis retained

ACH Analysis Note

Generated 4 hypotheses (H1 mature/uniformly hardened; H2 strong core + uneven periphery; H3 systemic gaps; H4 deliberate-exposure tradeoff). Scored against high-Admiralty evidence rows. H2 leads with ~0-2 weighted inconsistency; H1 carries ~9 weighted inconsistency (ishares.nl, no CAA, DMARC quarantine, iunits expiry, MDN F); H3 carries ~8 (active HackerOne + multi-tenant Okta + cert hygiene rule it out). H4 not credible given peripheral gaps include investor-facing surfaces.

Full hypothesis register and diagnostic evidence matrix will be surfaced here in schema v1.1 when analysis.hypotheses[] is promoted to a first-class structured field. Currently embedded in key judgment statements above.

§ 04

Key Assumptions Check

Assumptions whose failure would invalidate judgments

KAC Analysis Note

Surfaced 5 implicit assumptions across identity/currency/completeness/source-integrity/intentionality. Two HIGH-sensitivity assumptions: (a) Hunter-derived employee surface is current as of investigation, (b) Aladdin client tenant CT enumeration is representative not exhaustive. One MOD-sensitivity + MOD-confidence: analyst training cutoff Aug 2025 limits personnel-fact verifiability — folded into kj_010.

§ 05

Premortem — Failure Modes

Scenarios in which the leading assessment is wrong

Premortem Analysis Note

Tested H2 from the failure direction. Failure modes considered: (1) Harbor/Artifactory reachability if VPN/SSO weaker than evidence suggests (kj_005 conditioned); (2) DNRAdmin breach-corpus exposure unchecked (kj_011 surfaced gap); (3) analyst-knowledge fields stale post-Aug 2025 (kj_010 surfaced). All three folded into key judgments with confidence calibration.

§ 06

Collection Gaps & Priorities

1 tool gap · confidence ceilings affected

⊘ brave_web_search Gap

Collection gaps are structural limitations that create confidence ceilings on specific key judgments. See key judgment bodies above for gap callouts. Structural gaps — those requiring active engagement, legal process, or privileged access rather than additional tooling — will persist regardless of tool expansion.

Future schema versions (analysis.collection_priorities[]) will surface a ranked collection priority list directly from the analyze skill, enabling operators to queue follow-on tasking from this view.

§ 07

Indicators to Watch

Forward-looking · hypothesis confirmation / falsification

Forward indicators pending schema promotion

Indicators to watch — the specific observable events or data points that would confirm or falsify each key judgment's leading hypothesis — are currently embedded as prose within judgment statements and premortem failure modes above. In schema v1.1, the analyze skill will emit a structured analysis.indicators_to_watch[] array that this section will render as a proper watchlist, linkable to specific judgments and refreshable per-investigation.

Operators should review key judgment statements (§ 02) and the premortem note (§ 05) directly for current forward indicators.