Uhhhh well you see...yes, but no. Let us explain.

Odds are, wherever you live, you have a local police force. If you were to encounter trouble, you call them, they perform a Call for Service, and that's that. If there's a legitimate problem, it gets solved. However, most "Calls for Service" are accomplished in sub-10 minutes under normal department operating conditions. If there's an active crime in process, it essentially needs to hurry up before it's ceased "administratively". 

CyberSpace complicates law enforcement response. Threat actors, obviously, go out of their way to attempt to obscure their identities and digital fingerprints, and work incredibly quickly. By the time you're typically able to have an empowered actor at your defensive fingertips (yes, the FBI will indeed send out Cyber Response Teams if your business is targeted), your attacker/actor is long gone, and you've just summoned federal log searchers, essentially.

By shortening the lifecycle of threat detection itself, we achieve a greater impact in eCrime disruption, and there's benefit for all in that; and by engaging with your threat actor before they can harm you, we create an underground environment of deterrence if your business or organization generates too much friction, attention, anxiety, or constant difficulty to operate against. 

While there are some APT's and actors that will still challenge you regardless, a large component of disruptable eCrime, is what is essentially "skid eCrime" - committed by actors who don't operate at a level that is "up to a challenge", who will quickly avoid "fucking around and finding out" as the folks say nowadays.

In order to achieve our defensive goals, we may take extreme measures, including disabling infrastructure, launching effectively harmful counter-attacks, engaging in targeted counter-harassment and counter-exploitation, pursuing exploitative leads and suggestions, stealing and/or exposing data, and employing offensive psychological strategies.

We take precautions to avoid metaphorically catching innocent infrastructure in the "crossfire"; the majority of our activity does not have detrimental effects to unrelated parties except in extreme circumstances. Equally, while we won't openly list what qualifies a piece of infrastructure to us as "critical", if a TA has control of "critical infrastructure", we won't target it in a way that could remove its operation entirely. Equally, some categories of people are protected from the more eh...psychotic...variations, of what we may attempt to achieve; we don't target those under the age of adulthood in their own jurisdiction of residence, nor do we store data obtained during recon if we find someone under legal jurisdiction age. 

This is not "hackers-for-hire" in the sense of, "I pay people to attack other people at my beck and call". That would be some absolute Spy-Kids-level nonsense.

This is "hackers-for-hire" in the sense that this is friendly "hackers" utilizing traditional endpoint protection to collect intelligence on the people they get paid to engage and impede (malicious/unfriendly hackers), then strike them back. For you as the subject being defended, think of it as "throwing off flares" to an incoming munition.

Your internal red team is leashed and collared, dare we say buried in legal policies. If anybody from your internal red team walked into the Monday meeting and said "let's start hacking attackers back", they'd be laughed at because financially, there is only benefit in defending from the attacker, not investing internally into organization-level CTI. Meanwhile, your internal red team cracks no skulls, because they're not allowed to. Your red team and your legal team would have a courtyard brawl, to be honest. Your internal red team focuses on your organization, not it's adversaries and because of that, your red team doesn't threaten your threat actor. 

Suddenly, you place your attacker on a level playing field with operators of their own to contend with who have at their disposal, RE: mobilizable infrastructure, you just became an incredibly harsh pain in the ass to your attacker; who's likely to go find an easier target.

When your attacker started looking for weakness in your posture, the last thing they were expecting was active detection and resistance. This may sound like an extreme security strategy...but this is where we're at, honestly. 

NO

This is a professional, slightly cracked service aimed at enterprises that have things worth this level of protection. 

Our actions are within the bounds of security research and counter-intrusion. We are not "bricking" anybody, we are not "SWAT-ing" anyone, and we're not clicking "start" on a booter and giggling at the idea of CyberJustice; this isn't some example of "good guy hackers gone bad", nor an example of a Robin-Hood complex in-the-making.

The most effective protection is achieved with a force multiplier that is able to meet your attacker's challenge in near/real-time. That's us. No more, no less, and nothing illegal.  Our usage of "striking back" is metaphorical, to signify an action taken to bring a consequence in result. For example, we may strike back by working with a partner to disable or impede their infrastructure legally, or hunt and contribute information that results in desired counter-consequence, or by (as silly as it may sound) playing "mind games" with your intruder, or by tricking your intruder into self-executing a disabling payload; all up to the circumstance and capabilities of it. 

This is not the equivalent of a Cyber-Drive-By. This is not booting for hire. This is not internet harassment with a price. This is none of that. In the absolute most unoffensive way possible, if you look below and see the price for this service and cringe at it, you are not mature enough for us to tender this service to you, and that's okay.