A Russian-speaking broker ran two attack pipelines at once, and an open directory handed researchers the whole operation.