Speaker 1: Pushkin. Just a quick note, this is a bonus episode
Speaker 1: of What's Your Problem, and it's sponsored by Microsoft. John
Speaker 1: Demaggio studies cybercrime for a living. It's his job. But
Speaker 1: when he wanted to understand an international cybercrime gang called
Speaker 1: lock Bit, he realized he couldn't learn everything he wanted
Speaker 1: to know from the outside, so he started trying to
Speaker 1: figure out how to get people on the inside to
Speaker 1: tell him what he needed to know.
Speaker 2: So I spent a lot of time studying going back
Speaker 2: to World War Two when they started having all these
Speaker 2: documents about how to use the human trade craft to
Speaker 2: sort of recruit and convince people to do things that
Speaker 2: they don't necessarily know that they're doing to support your cause.
Speaker 1: So were you telling me you started studying sort of
Speaker 1: World War two era spycraft.
Speaker 3: Yes, that's correct.
Speaker 1: What's something you learn from World War two era spycraft
Speaker 1: that helped you weasel your way into a ransomware gang?
Speaker 2: Everything from their ego to understanding who their adversary is
Speaker 2: and making them feel that being friends with you will
Speaker 2: benefit them because you have a common enemy, or even
Speaker 2: even being adversarial towards them and saying certain things just
Speaker 2: to see what the reaction is to sometimes understand the truth.
Speaker 3: There's also the sort.
Speaker 2: Of the plan and prepare phase where you have to
Speaker 2: go and sort of stalk them and understand who their
Speaker 2: contacts are, who their friends are, who their enemies are,
Speaker 2: where they hang out online, all of that stuff.
Speaker 1: So you have this set of strategic ideas in your mind,
Speaker 1: what do you actually do?
Speaker 3: So what I did.
Speaker 2: The first thing I did is I needed to figure
Speaker 2: out sort of their digital fingerprint, so I profiled them.
Speaker 2: I began looking across the dark web. Obviously started with
Speaker 2: the easy One, their data leak site, their own infrastructure,
Speaker 2: and I went from there and I eventually found the
Speaker 2: forums that they live on. And there's some very prominent
Speaker 2: Russian hacking forums that have been around for about twenty years,
Speaker 2: so it made sense to start there. And sure enough,
Speaker 2: they were very prevalent on that website. They were very
Speaker 2: involved with conversations, They have friends, their enemies, and they
Speaker 2: do their business. So they actually would go there just
Speaker 2: to talk and sort of hang out with their buddies.
Speaker 2: And the drama, it was like it was like a
Speaker 2: soap opera. The drama these guys would getting these big
Speaker 2: arguments are the stupidest things. I just started profiling and
Speaker 2: visually mapping out who is who, who they were talking to,
Speaker 2: what those other people's roles were. Again, then I would
Speaker 2: find the ones who are their friends, and I would
Speaker 2: try to approach them and the people who worked for them.
Speaker 1: And did it work.
Speaker 3: It did well, It sort of worked.
Speaker 1: I'm Jacob Goldstein, and this is what's your problem. My
Speaker 1: guest today is John DiMaggio. John is the chief security
Speaker 1: strategist at a company called Analyst One, and I wanted
Speaker 1: to talk with John about Lockbit, this ransomware gang that
Speaker 1: was behind attacks that extorted over one hundred million dollars
Speaker 1: from companies around the world. John wrote this sort of
Speaker 1: book length series of online posts about Lockbit. It was
Speaker 1: part of a thing John called the Ransomware Diaries. The
Speaker 1: story of Lockbit is a great window into the ransomware industry,
Speaker 1: and it is an industry with a lot of remarkable
Speaker 1: similarities to ordinary non criminal industries. Lockbitch tried to brand itself,
Speaker 1: It tried to attract talent and notch keywins, just like
Speaker 1: any software company. But then there's also the part that
Speaker 1: is not like any software company. There is the crime part,
Speaker 1: and it was the crime part where Lockbit went too
Speaker 1: far and wound up drawing the ire of international law
Speaker 1: enforcement agencies that in fact have their own set of
Speaker 1: innovative strategies. And John watched all this happen up close.
Speaker 1: He told me his key contact on the inside had
Speaker 1: the user name lock bits up, short for Lockbit Support.
Speaker 2: I didn't know it at the time when I first
Speaker 2: started talking to them, but what I found out as
Speaker 2: I began to talk more is there were two personalities
Speaker 2: behind the account.
Speaker 3: One seemed to be much.
Speaker 2: Younger, friendlier, more in tune with sort of pop culture,
Speaker 2: and the other one, who I gave a name mister
Speaker 2: grumpy Pants, because he was all business, always serious, and
Speaker 2: that was kind of how I differentiated.
Speaker 1: Tell me about the sort of conversations you had with
Speaker 1: lockbits up, like, what was the nature of those exchanges.
Speaker 3: Well, so you have.
Speaker 2: To understand that when I did the initial part that
Speaker 2: was sort of cover pretending to be somebody else. I
Speaker 2: only got so far with that, and after I wrote
Speaker 2: The Ransomware Diaries Volume one, they knew who I was.
Speaker 2: The farthest I got was talking to them is myself,
Speaker 2: and they you know, it was just I started with with, Hey,
Speaker 2: do you guys know who I am? I want to
Speaker 2: have a conversation with you, And they were, you know,
Speaker 2: said to me, yeah, your favorite researcher. We love you, okay,
Speaker 2: And they were very willing to talk, which is why
Speaker 2: I got so much farther talking to them as myself
Speaker 2: as I did pretending to be a hacker.
Speaker 1: Uh Huh. What's the thing you learned from lock bits up?
Speaker 1: What's a what's a What's one detail of your understanding
Speaker 1: that was improved by that relationship?
Speaker 2: Well, there were a lot of things, but one of
Speaker 2: the key things I had learned was information about uh.
Speaker 2: They prob internal problems that they had with affiliates. For example,
Speaker 2: they complained that they've got really good hackers, but some
Speaker 2: of these hackers are younger kids, and they're good at hacking,
Speaker 2: but they're really bad at negotiating, uh, And he was.
Speaker 2: They were unhappy about the amount of money coming in,
Speaker 2: so they talked about that and coming up with a
Speaker 2: with a model of how much they would accept, and
Speaker 2: they created sort of a formula per company, and so
Speaker 2: just things like that, things around tech resources. They asked
Speaker 2: me one time if I would buy them. They couldn't
Speaker 2: get a they they couldn't get a Domain tools account,
Speaker 2: and they wanted to know because they couldn't pay for
Speaker 2: it with crypto, they want to know if I would
Speaker 2: buy it for them, which, of course they're playing with me,
Speaker 2: you know. And it was sort of a cat and
Speaker 2: mouse fun relationship for a while of going back and forth.
Speaker 2: So it was friendly for most of our relationship until
Speaker 2: it wasn't.
Speaker 1: So okay, So you're in this world and I just
Speaker 1: want to step back for a minute to talk about
Speaker 1: what's going on in a big way. Right, there's this
Speaker 1: phrase that's sort of central here, which is ransomware as
Speaker 1: a service. Ransomware is like straightforwards something a lot of
Speaker 1: people are familiar with. It's basically, some bad actor, some hacker,
Speaker 1: hacks into some companies' computers, locks them up and says
Speaker 1: we're not going to unlock them unless you pay us
Speaker 1: a ransom. That's ransomware.
Speaker 3: Exactly.
Speaker 1: What is ransomware as a service? What is I mean?
Speaker 1: We know about software as a service, right, it's basically
Speaker 1: you pay whatever amount of a month and you get to
Speaker 1: use software. What's ransomware as a service.
Speaker 2: So ransomware is a service. There's more than just ransomware.
Speaker 2: So you have this two part model where you have
Speaker 2: a service provider. That service provider provides the actual ransomware code.
Speaker 2: They also provide infrastructure. So the provider provides these services,
Speaker 2: the hacker goes and does the dirty work of actual hacking,
Speaker 2: and together when a victim pays the extortion, they share
Speaker 2: the profit from it. The benefit from using this model
Speaker 2: is you can have a lot higher volume than if
Speaker 2: it was just five guys in a group doing it themselves.
Speaker 2: By using this model, you can have many people doing
Speaker 2: attacks on your behalf. Much higher volume of attacks, much
Speaker 2: higher revenue.
Speaker 1: So Lockbit is basically just a software company. They're like
Speaker 1: an enterprise software company. They write software and provide various
Speaker 1: tools for users. But in this case the users are criminals,
Speaker 1: are people who want to hack into various computer systems
Speaker 1: and steal data and extort money.
Speaker 3: That's correct.
Speaker 2: But the other piece to it is the service provider aspect.
Speaker 2: They're the ones that are sort of in charge, that
Speaker 2: run the show, that give direction, that step in whenever
Speaker 2: there's an issue, if there's a victim not paying, sometimes
Speaker 2: they'll come in and help with the negotiation or take
Speaker 2: over or give direction on how much you can you
Speaker 2: can accept as a payment, or even say this is
Speaker 2: what you can or cannot hack this company. So they're
Speaker 2: definitely in the leadership chair.
Speaker 1: So I want to talk about how lockbit sort of
Speaker 1: grows and makes a name for itself. And one of
Speaker 1: the things that's really interesting is kind of how uninteresting
Speaker 1: it is. It's like, oh, it's this international criminal gang
Speaker 1: and they're acting like a boring software company, and it
Speaker 1: seems like a key early moment for them as they're
Speaker 1: trying to grow and differentiate themselves in the market. Is
Speaker 1: this summer paper contest in to tell me about that?
Speaker 3: Yeah, it's it's pretty crazy.
Speaker 2: So on this long running forum that I mentioned earlier,
Speaker 2: this Russian hacking forum, lockbit really wanted to to get
Speaker 2: their brand out there. So what they did is they
Speaker 2: sponsored this hacking paper contest, meaning hackers would submit these
Speaker 2: papers on different ways to hack and lockbit they would
Speaker 2: they would take part in this and they would help review.
Speaker 2: And there was five winners and the I think I
Speaker 2: don't remember what the what the what the I think
Speaker 2: was five thousand dollars maybe.
Speaker 1: Uh, you put a screenshot in your report. And what's
Speaker 1: amazing is how banal. It looks it looks totally like
Speaker 1: some college software contest or just some boring enterprise software company.
Speaker 1: Like there's this little kind of clip art of just
Speaker 1: like a dude at a laptop with a little plant
Speaker 1: next to him, although there is also a skull and
Speaker 1: crossbones next to him. It's like, we're just coders, but we're bad.
Speaker 1: And as you said, first place is five thousand dollars,
Speaker 1: which seems like not that much. Right, they're exploiting that.
Speaker 1: They're stealing tens of millions of dollars at this point, right.
Speaker 1: And then it says like accepted article topics, just like
Speaker 1: it would in a college contest, but under accepted article topics,
Speaker 1: it says hacks any methods for pouring shells, fixing, elevating rights,
Speaker 1: your story is and tricks interesting hack stories. It's such
Speaker 1: a fantastic combination of well banality and evil.
Speaker 3: It is.
Speaker 2: But here's what you have to think about. There's two
Speaker 2: benefits for this. One what I mentioned, sort of getting
Speaker 2: their name out and getting known with hackers. But two,
Speaker 2: they're looking for those upcoming rising stars, if you.
Speaker 1: Will, recruitment. It's talents, right, and yeah.
Speaker 2: That's right, and that's why Lackbit was different than most
Speaker 2: of these are the ransomware groups, because they approached it
Speaker 2: is a business and they thought out of the box
Speaker 2: and that's kind of what would set them ahead in
Speaker 2: a part at the time from other ransomware groups.
Speaker 1: So does it work this strategy?
Speaker 3: It absolutely worked.
Speaker 2: I mean, there's a reason that people know their name
Speaker 2: and know who they are, and there's a reason that
Speaker 2: they have so many people that at the time in
Speaker 2: a way really wanted to work for them over other groups.
Speaker 2: It was propaganda and it worked.
Speaker 1: And so it seems like by around twenty twenty one
Speaker 1: they've hit the big time. And there's this one hack
Speaker 1: in particular that you write about in the summer of
Speaker 1: twenty one of Accenture, the big international consulting company. Tell
Speaker 1: me about the Accenture hack.
Speaker 2: So in the Accenture hack, you know, the affiliate had
Speaker 2: gone in compromised them, they locked down their data, and
Speaker 2: lock Bit, you know, put on their site that you
Speaker 2: know they were a victim. Reporter started to report about it,
Speaker 2: and you got a lot of buzz in the media. Now,
Speaker 2: the problem with the Accenture hack is that Accenture denied
Speaker 2: that the hack took place. Initially saying that it wasn't
Speaker 2: real and it didn't happen. The issue with that is
Speaker 2: their customer's data was on their website and you could
Speaker 2: you could go see it and validate it and download
Speaker 2: samples of it.
Speaker 1: The customer's data was on the lockbit website.
Speaker 3: That's correct.
Speaker 2: That's correct, and it was just a sampling, but you
Speaker 2: could see this information and it looked quite authentic.
Speaker 1: So so does this accenture hack sort of put Lockbit
Speaker 1: on the map in a bigger way?
Speaker 3: Oh? I mean the media surrounding that was was was
Speaker 3: very loud.
Speaker 2: I mean it was across many organizations. Lots of of
Speaker 2: of well known journalists and organizations reported on it. All
Speaker 2: this feeds into the propaganda. Now the journalist shouldn't report
Speaker 2: on it. I'm just saying, you know, lockbit plays that
Speaker 2: to benefit him as them as well.
Speaker 1: Yeah, So basically the press coverage is good for lockbit
Speaker 1: because hackers see it and go to lockbit and say, hey,
Speaker 1: I want to be an affiliate and do some hacking.
Speaker 2: Essentially, that's right, and to be fair, the same thing
Speaker 2: from me from writing these reports. Yes, it helps researchers
Speaker 2: law enforcement, but it also helps them that that's the
Speaker 2: reason that they were friendly to me is because they
Speaker 2: were fans of a lot. I have probably just as
Speaker 2: many criminal hackers that are fans of the ransomware diaries
Speaker 2: as there are researchers and you know, right, regular people
Speaker 2: that are not criminals.
Speaker 1: Well, I mean there's an ecosystem here, right, like the
Speaker 1: the job. There's a universe of people whose job is
Speaker 1: fighting criminals and a universe of people who are criminals
Speaker 1: who are trying to evade being caught. Right, And that's right,
Speaker 1: the kind of intellectual universe has got to be almost
Speaker 1: entirely overlapping. Everybody's trying to figure out what everybody else
Speaker 1: is doing. Everybody's sort of using the same tricks on
Speaker 1: each other. It makes sense that the bad guys and
Speaker 1: the good guys would be reading the same.
Speaker 3: Stuff it does.
Speaker 2: And you know that's really where that uh that that
Speaker 2: that that human framework came in because his ego was
Speaker 2: was the main thing I was able to play on
Speaker 2: in order to get information. And even when there were
Speaker 2: lies in that information, you know, I talked to the
Speaker 2: people who work for them, So I would take those
Speaker 2: lies and I would present them in a different way
Speaker 2: to those people to get a response, and that would
Speaker 2: help me to validate what's real and what's not.
Speaker 1: Is there some specific example of playing on his ego,
Speaker 1: something you said to flatter him or something.
Speaker 2: Uh well, yeah, you know one of the one of
Speaker 2: the things that that was big for him was, you know,
Speaker 2: he wanted to be sort of the Darth Vader of
Speaker 2: ransomware of my words, not his, but you know, he
Speaker 2: he wanted to be this this top person. So you
Speaker 2: know when you would talk about him changing the game
Speaker 2: of ransomware and telling him, you know, you guys are
Speaker 2: are are on top? You know, how did you get there?
Speaker 2: How did you how did you get ahead of other
Speaker 2: groups like like REvil and uh in in time, Black Matter,
Speaker 2: in groups like that, And you know he loved that.
Speaker 2: You know, it would just that was a thing that
Speaker 2: would get mister grumpy pants talking was sort of playing
Speaker 2: on his ego, you know, asking questions about how he
Speaker 2: got to be the top brand in ransomware and how
Speaker 2: he's better than all the other ones.
Speaker 3: And he fed right into that.
Speaker 1: Coming up after the break, what happens when lockbit is
Speaker 1: used to hack a hospital for children with cancer, So
Speaker 1: kind of early twenty twenties Lockbit is king of the
Speaker 1: ransomware world. And then it seems like in about twenty
Speaker 1: twenty three they sort of start going too far or
Speaker 1: their affiliates start going too far right, they start to
Speaker 1: get into trouble, and it seems like the back of
Speaker 1: hospital that is actually called Thick Kids, which is yeh,
Speaker 1: a children's cancer hospital in Canada, is kind of a
Speaker 1: turning point. And like I do wonder, like you could
Speaker 1: hack anybody, why would you hack a cancer hospital for children? Like,
Speaker 1: is it because you want to be as evil as possible?
Speaker 2: Yeah, it's because they see them as a as an
Speaker 2: easy target because a hospital has to be available and
Speaker 2: make their resources easily accessible by their patients, clients, medical organizations,
Speaker 2: and inherently the more accessible something is less secure it is.
Speaker 2: So it makes them an easy target. They have a
Speaker 2: lot of money, and they're more likely to pay because
Speaker 2: the data is so sensitive and the systems that are
Speaker 2: encrypted are so critical that it makes them a ripe
Speaker 2: target and that's the reason that they'll go after them. Initially,
Speaker 2: the hospital was hacked, the systems were encrypted, data was stolen,
Speaker 2: and they didn't they weren't going to let them out
Speaker 2: of this. They were going to force them to pay
Speaker 2: or they weren't going to give them the key to
Speaker 2: decryptor systems, and didn't seem to care that these kids
Speaker 2: couldn't get the care that they needed and the treatments
Speaker 2: that they needed. The only reason so what ended up
Speaker 2: happening was with all the media around it, it was
Speaker 2: such a bad look for Lockbit that the leadership of
Speaker 2: the group decided, after you know, about two weeks, they decided, Okay,
Speaker 2: we're going to go ahead and we're going to give
Speaker 2: them the cryption key, just because this was getting to
Speaker 2: be too hot. And if you remember, like the whole
Speaker 2: Colonial Pipeline thing with the Dark Side ransomware group, you
Speaker 2: know that got that got so much attention that you know,
Speaker 2: government agencies got involved and went after them, and when
Speaker 2: that happens, it's very bad for ransomware groups. So they
Speaker 2: essentially saw things could possibly go that direction with the
Speaker 2: amount of bad publicity they were getting, and decided it
Speaker 2: wasn't worth it the payment they were going to get,
Speaker 2: and they went ahead and provided the hospital with the
Speaker 2: decryption key so they could get those systems back online.
Speaker 1: And and in fact, their concern about a backlash was justified. Right,
Speaker 1: it seems like international governments, kind of led by the UK,
Speaker 1: do start to go after Lockbit around this point. Right,
Speaker 1: What do you do if you're a government and you
Speaker 1: want to go after a Russian hecking gang?
Speaker 2: Well, it's not easy. The things that you have to
Speaker 2: do is you have to use resources that people like
Speaker 2: me don't have available to try to figure out their
Speaker 2: their infrastructure, their hosting infrastructure, what what what where their
Speaker 2: servers live? Uh, and then which is very difficult when
Speaker 2: they're there the dark web.
Speaker 3: It's hard to figure.
Speaker 1: That out because there's this is the cat and mouse thing.
Speaker 1: They're like complicated smart systems. These people used to hide
Speaker 1: their location essentially.
Speaker 2: That's that's right, and so that's one aspect is trying
Speaker 2: to figure out that infrastructure.
Speaker 3: In some cases you.
Speaker 2: Can use legal means to take it down, but with
Speaker 2: groups like Lockbit, often they will use service providers that
Speaker 2: are in countries that cater to criminal activity and won't
Speaker 2: respond subpoenas. The other thing, though, that lawn that these
Speaker 2: governments and law enforcements try to get into is the
Speaker 2: infrastructure that is public, the panel that the bad guys
Speaker 2: use to log into with the graphical interface to control
Speaker 2: these attacks, and there's technical ways to do that, and
Speaker 2: then there's also the ways of infiltrating the people who
Speaker 2: work for the group to get their credentials access.
Speaker 1: So they're basically hacking. They're basically hacking the hackers. So
Speaker 1: in February of twenty twenty four, this international coalition of
Speaker 1: law enforcement agencies actually takes over lockbit sort of publicly
Speaker 1: facing site, right Lockbit's dark websites tell me about that.
Speaker 2: Yeah, So it was great when you went to the
Speaker 2: website that that day, it was no longer Lockbit's data
Speaker 2: leak site. Instead it was a mock site, so it
Speaker 2: looks just like it, except instead of having real victims
Speaker 2: within the site, the NCAA put the criminals as the victims,
Speaker 2: and they named affiliates with the victims, and they had
Speaker 2: a countdown timer for for lock bits up saying they
Speaker 2: were going to release his identity ha.
Speaker 1: And the countdown timer is the kind of thing that
Speaker 1: the that the bad guys use when they hack a company,
Speaker 1: saying we're gonna.
Speaker 3: That's rite yeah, uh huh, yeah, that's what they do.
Speaker 2: A count down timer for traditional victims is how long
Speaker 2: they have to pay to the data's lead so in.
Speaker 1: The same way that Lockbit was essentially marketing itself. Now
Speaker 1: the now the cops, now the law enforcement officials, are
Speaker 1: are doing that same kind of marketing. They're sort of
Speaker 1: doing this kind of propagandistic thing to attract attention, presumer
Speaker 1: what to scare off all the affiliates, like why why
Speaker 1: would they be doing it in this showy way just
Speaker 1: for attention to get good press.
Speaker 2: No, it was it was a psychological operation. So prior
Speaker 2: to this, they didn't they never did this there. The
Speaker 2: way they took sites down were just to take it
Speaker 2: down and put a message up saying law enforcement took
Speaker 2: this down. This was psychological. It was meant to put
Speaker 2: stress on the people who worked for the organization and
Speaker 2: being concerned that they no longer had anonymity and that
Speaker 2: their names and information was now being reviewed and revealed
Speaker 2: by law enforcement. And the whole goal of this was
Speaker 2: was to affect the lockbit brand and to make people
Speaker 2: not trust Lockbit.
Speaker 3: Or want to work for the organization.
Speaker 2: So it was very planned in, thought out and methodical.
Speaker 2: It wasn't just, you know, to get attention. It was
Speaker 2: specifically to hurt that brand and make affiliates afraid to
Speaker 2: work for them. And in addition to that mock website
Speaker 2: on the back end that panel that I was mentioning
Speaker 2: that admin paneled that they would use now when that
Speaker 2: took place, when the takedown took place, when the affiliates
Speaker 2: logged into that panel, they had tailored messages with their
Speaker 2: username by law enforcement saying, hey, you're logging into the panel.
Speaker 3: We know who you are.
Speaker 2: We've been monitoring the activity you've been doing. We've got
Speaker 2: your wallets. We're going to be coming to talk to
Speaker 2: you soon. So it was it was very detrimental to criminals.
Speaker 2: That was a brilliant operation in my opinion.
Speaker 1: And you mentioned that they had a countdown timer for
Speaker 1: when they were going to reveal the name of Lockbit,
Speaker 1: sup the person. Oh that you said, there's people, but
Speaker 1: at least one of the people behind this, behind Lockbit,
Speaker 1: one of the key Lockbit players. Did they in fact
Speaker 1: reveal the name of that person.
Speaker 2: They didn't when the countdown time, or they didn't when
Speaker 2: they did they at that time they didn't, but there's
Speaker 2: a reason that they didn't. But they did not do
Speaker 2: that in February. The reason that they didn't is because
Speaker 2: Lockbit agreed to tell them information about some of his
Speaker 2: adversarial group. There was a group called black who he
Speaker 2: didn't like, and he agreed to try and get to
Speaker 2: give them information.
Speaker 1: So use they used the threat of naming him as
Speaker 1: leverage and getting him to flip. Basically, that's correct. Do
Speaker 1: we know who he is now? Was he ever named?
Speaker 3: Yeah? It was.
Speaker 2: It was several months later. The site came back online,
Speaker 2: meaning the law enforcement version of the site came back online.
Speaker 2: There was a new timer, and once again they said
Speaker 2: they were going to reveal Lockfit's name, and the timer
Speaker 2: began again, and on May seventh, when that timer expired,
Speaker 2: they did. They released his name and his picture, Dmitry Koshewev.
Speaker 2: They put that out there, indicted him, wanted posters the
Speaker 2: whole nine yards.
Speaker 1: Is that grumpy pants?
Speaker 3: That's well my opinion.
Speaker 2: My opinion is that that was the younger person and
Speaker 2: the other guy's still out there, but I think law
Speaker 2: enforcement might tell you otherwise, though they do agree with
Speaker 2: me that there's two people.
Speaker 1: So he's been indicted but not arrested. Is that what
Speaker 1: you're saying?
Speaker 2: That's correct because he's in Russia and there's protections there.
Speaker 2: The law enforcement just can't get their hands on them. Unfortunately,
Speaker 2: the criminals are protected when they're in Russia.
Speaker 1: So is that the end of Lockbit?
Speaker 2: It's not, you would think it is, But most almost
Speaker 2: every other group that this has happened to, that's the
Speaker 2: end of the story, or at least it causes them
Speaker 2: to take that operation down and they have to start
Speaker 2: from scratch somewhere else with a new operation, with a
Speaker 2: new name and a new brand. But Lockbit worked so
Speaker 2: hard on that brand. I don't think he'll ever take
Speaker 2: it away until he's till they actually arrest everybody. But no,
Speaker 2: they continued, but they continued at a much lower level.
Speaker 2: They didn't have the equality of hackers still working for them.
Speaker 2: They started having to lie about attacks to try and
Speaker 2: stack the numbers and things of that nature.
Speaker 1: Do you think they'll unforcement officials campaign the whole thing
Speaker 1: of like naming the people and doing all the stunts
Speaker 1: on the website. You think that worked? You think it
Speaker 1: was sort of like Lockbit rose on marketing and in
Speaker 1: a way fell on the marketing of the governments.
Speaker 2: Yeah, well, was it one hundred percent effective, No, but
Speaker 2: it was about eighty percent effective. And prior to this,
Speaker 2: I would say that most of those operations were like
Speaker 2: forty percent effective. And what I mean by that is
Speaker 2: this actually affected the brand where people, the quality hackers,
Speaker 2: the quality affiliates. Why would they work for this organization
Speaker 2: with all this heat where they can't trust that they're
Speaker 2: going to be protected when they can go work for
Speaker 2: some other premier worgans.
Speaker 1: Like any software company. Their biggest problem is finding and
Speaker 1: keeping good people.
Speaker 3: That's right, That's exactly right.
Speaker 1: And by good people, I guess in this case, it
Speaker 1: means bad people, right. So okay, so this is a
Speaker 1: year ago. Basically, this is early twenty twenty four. Lockbit
Speaker 1: gets mostly taken down, not knocked out, at least knocked down.
Speaker 1: Where are we today, Like, what is the state of
Speaker 1: the ransomware industry?
Speaker 2: So it's changed a bit. I would say you have
Speaker 2: more groups, but you don't have sort of these. You
Speaker 2: don't have as many big organizations that sort of hold
Speaker 2: all the majority of attacks. You have smaller to medium
Speaker 2: sized groups that work more under the radar, meaning they're
Speaker 2: not doing the same volume of attacks. They're also not
Speaker 2: getting the same amount of money and ransom extortions as
Speaker 2: they did before. But they're still out there. They're just
Speaker 2: doing it, the model just changed a little bit.
Speaker 1: And so as part of the idea that, oh, maybe
Speaker 1: trying to have a big name and be like a
Speaker 1: famous criminal gang is not a good long term strategy.
Speaker 3: That's exactly correct.
Speaker 2: I think that this is what really made them realize
Speaker 2: that people are sort of lower on the radar, just
Speaker 2: trying to get money and extort, but not necessarily have
Speaker 2: this voice that's heard across the world.
Speaker 1: What's like, what's the big lesson to you from the
Speaker 1: Lockbit story.
Speaker 2: The big lesson there is being voisterous. Having this ego
Speaker 2: is actually a downfall. Being loud, getting publicity, getting your
Speaker 2: name out there, well, that might help attract people to
Speaker 2: come work for you. There's the opposite side of that,
Speaker 2: where it also attracts a lot of attention from law enforcement,
Speaker 2: and if you're a criminal group, that's not a good thing.
Speaker 2: And I think bad guys have figured that out between
Speaker 2: mainly from twenty twenty four with both the black Cat
Speaker 2: ransomware group and with Lockbit. Those were your prominent players,
Speaker 2: and those guys both got decimated by law enforcement, and
Speaker 2: that happened because of the attention that they drew to themselves.
Speaker 2: So I think That's the lesson that adversaries have learned
Speaker 2: is you have to be quieter about what you do.
Speaker 1: Lively. Back in a minute with the lightning round. Let's
Speaker 1: finish with the lightning round. It's gonna be a little
Speaker 1: more random and a little more about you. Okay, what's
Speaker 1: one thing you learned when you hacked into the Pentagon
Speaker 1: as a fifteen year old boy?
Speaker 2: Oh man, That's the reason that had I talked to
Speaker 2: these criminals and I sometimes have empathy to want to
Speaker 2: help them change what they're doing, is because I got
Speaker 2: a second chance, and I remember that fear, and I
Speaker 2: want to try to help some of these young kids
Speaker 2: to change what they're doing and not continue down this road.
Speaker 1: What actually happened there? What was it that happened?
Speaker 2: Yeah, So my stepfather worked for Colon Powell during the
Speaker 2: Iraq War. He was at the Pentagon and he had
Speaker 2: a classified system in our basement, and I had a
Speaker 2: friend over and I was really into computers and hacking
Speaker 2: figuring things out. And I didn't do anything elaborate. I
Speaker 2: just figured out his credentials and I logged in and
Speaker 2: was put looking around. Nothing elaborate, but enough that it
Speaker 2: got attention and bad things happened, and and the FBI showed.
Speaker 3: Up and things.
Speaker 1: The FBI showed up at your house.
Speaker 3: Yeah they did. It was It was not a good
Speaker 3: day for me.
Speaker 1: I'm glad it worked out in the end. It did.
Speaker 3: It did.
Speaker 2: It only worked out though, because of who he worked for,
Speaker 2: my stepfather, and the connections that he had, and the
Speaker 2: fact that I had no prior record. That's the reason
Speaker 2: that it worked. And I had a summer where I
Speaker 2: had to go work at Fort Belvoir doing community service,
Speaker 2: but I just do such a good job they wanted
Speaker 2: to hire me to work there. So it was definitely
Speaker 2: a life changing experience. And then I joined the army
Speaker 2: and became a military police officer. So that was my story.
Speaker 2: But it worked out well for him.
Speaker 1: So I understand that when you were a military police officer,
Speaker 1: you did undercover drug bys I did. What's something you
Speaker 1: learned doing undercover drug byes as a military police officer?
Speaker 2: What I learned is it's not black and white. It's
Speaker 2: not just you're a bad guy or a good guy.
Speaker 2: There are there there's still human beings.
Speaker 1: What's one thing you learned pushing carts at home depot.
Speaker 2: That you should never have an ego because I did
Speaker 2: all that crazy work and I got out and I
Speaker 2: could not get a job in law enforcement because of
Speaker 2: my tattoos. At the time, you couldn't have visible tattoos,
Speaker 2: at least in Virginia. Tried to join the FBI because
Speaker 2: I smoked weed in high school at the time, day
Speaker 2: at a zero tolerance.
Speaker 3: I couldn't get into that. I didn't couldn't get.
Speaker 2: A job, and I had to start at the very bottom.
Speaker 2: I've been working retail. I'm not even in the store.
Speaker 2: I'm in the parking lot, you know. That was I
Speaker 2: was living out of my truck for a couple of weeks,
Speaker 2: and then I rented a room at a house. That house,
Speaker 2: they were selling.
Speaker 3: Drugs out of the house.
Speaker 2: The cops raided it, rested everybody but me, but I
Speaker 2: couldn't even get in the house to get my stuff.
Speaker 3: I mean, it was a tough time in my life.
Speaker 1: I'm going to change gears to talk about something much
Speaker 1: more pedestrian. Now, what's your favorite depiction of hacking in
Speaker 1: a work of fiction? Uh?
Speaker 2: Corey Uh, there's an author, Corey Doctro, brilliant guy. He's
Speaker 2: one of my favorite authors, and he does hacker fiction
Speaker 2: if you will, and he's got a probably twenty books now,
Speaker 2: but they're they're phenomenal, especially the Homeland series. That's one
Speaker 2: of my favorite.
Speaker 1: Okay, Homeland series. Who's your favorite cyber criminal in real life?
Speaker 2: I would probably say the hacker known as us D
Speaker 2: O D. He is a He is a hacker who's
Speaker 2: not Russian. Uh. He lives in Brazil. I became very
Speaker 2: good friends with him. I've never written about him. He
Speaker 2: wasn't a target of mine. He helped me actually when
Speaker 2: I was going after ransom VC and he gave me
Speaker 2: a lot of good insight information and we just became
Speaker 2: friends for a long time and we talked and he
Speaker 2: was somebody who I really had wanted to help. He's
Speaker 2: in jail now, so you can figure out if I
Speaker 2: was able to help him or not.
Speaker 1: Why? Why him? What was what was that relationship?
Speaker 2: You know, he had issues like like everybody, but you know,
Speaker 2: he was a he had a good side to him.
Speaker 2: There was a side to him. He was a decent
Speaker 2: person and I really thought if he hadn't become a criminal,
Speaker 2: he's somebody that would have been in the cybersecurity field.
Speaker 2: He did have empathy for people. He hated law enforcement
Speaker 2: in the government, but he did have empathy for people,
Speaker 2: and he was somebody who I could talk to and
Speaker 2: and actually feel like I could I could make a
Speaker 2: difference with the conversations that we had.
Speaker 1: John DiMaggio is the chief security strategist at Analyst One.
Speaker 1: Today's show was produced by Gabriel Hunter Chang. It was
Speaker 1: edited by Lydia Jean Kott and engineered.
Speaker 3: By Sarah Buguer.
Speaker 1: I'm Jacob Goldstein and we'll be back later this week
Speaker 1: with another episode of What's Your Problem. A port Asner
Speaker 1: SA