Researcher Infiltrates LockBit, Faces Death Threats

John DiMaggio confirmed his collaboration with the FBI and the National Crime Agency (NCA), an effort that resulted in the indictment and public identification of individuals involved in ransomware activities.

The operation, while successful in bringing cybercriminals to justice, triggered significant death threats against DiMaggio, highlighting the dangerous real-world consequences of such investigations.

DiMaggio spoke about the profound psychological burden he experienced while investigating cybercriminals, particularly when confronted with their devastating real-world impact.

A critical turning point for his resolve was an incident where LockBit took down a children's cancer hospital, which he described as fueling intense feelings of 'hate, rage, and vengeance' within him.

The emotional toll of these investigations significantly affected his personal relationships and mental health, underscoring the deep human cost of this line of work.

A lack of traditional data sources forced DiMaggio to pivot toward dark web profiling, where he created fake personas to infiltrate groups like LockBit over 18 months.

He developed fake personas to build rapport and infiltrate ransomware gangs, successfully earning the trust of the LockBit group over an 18-month period through these clandestine interactions.

After DiMaggio's research report was published, LockBit members surprisingly used his face as an avatar and, upon contact, humorously claimed he was their favorite researcher.

They even joked that he resembled 'Chuck Norris,' though DiMaggio believed they might have confused him with Bruce Willis, highlighting an unexpected and bizarre rapport with the cybercriminals.

The FBI knocked on his door to notify him of specific threats, an event DiMaggio identifies as the start of a life where maintaining stable personal relationships became nearly impossible.

Pursuing intense, high-stakes investigations makes it difficult to maintain a normal life, and DiMaggio admits that a spouse would further complicate his current, demanding routine.

He expressed a long-term goal of transitioning to less stressful work, acknowledging the difficulty of stepping back when he feels his efforts are making a significant and positive difference in the world.

The team communicated via a signal group humorously named 'the ransomware gang,' with each member writing their own chapters to collectively document their investigative processes and findings.

A hacker, after accumulating substantial illicit wealth, attempted to exit cybercrime, but his Russian handlers disapproved of his departure.

While visiting family in Kiev, he faced interrogation by authorities who confronted him with Telegram evidence linking him to election hacking, a situation confirmed by his Russian handler as requiring his cooperation to resolve legal issues.

This incident revealed the intricate web of corruption, including involvement with Russian intelligence and pre-war operations in Ukraine, that entraps cybercriminals.

Yaroslav was coerced into cybercrime by a ransomware gang who threatened his girlfriend and mother, compelling his participation in their activities.

Following his recruitment, he attempted to report his situation to the FBI via email, but received no response, further complicating his dire circumstances.

The REvil gang, with Yaroslav's involvement, launched a major attack on Kaseya, a Managed Service Provider (MSP), in July 2020.

During the attack's execution, Yaroslav deliberately appeared on mall security cameras, attempting to establish an alibi to distance himself from the cybercrime.

The Kaseya incident, which demanded a $70 million ransom, impacted approximately 1,500 organizations globally, including critical infrastructure like hospitals, schools, and government bodies.

This widespread attack captured the attention of President Joe Biden, leading the U.S. to officially reclassify ransomware as a national security issue, thereby authorizing the involvement of intelligence agencies such as the CIA and NSA in investigations.

Yaroslav, despite being charged with all of REvil's crimes, maintained his silence throughout the trial and refused to enter into a plea deal.

His defense was managed by an attorney known for representing Russian intelligence and organized crime figures, a background that informed his legal strategy.

Ultimately, Yaroslav was sentenced to 14 years in prison and held responsible for an estimated $600 million in damages attributed to the REvil group, while the actual leader of the group evaded capture and disappeared with the illicit proceeds.

DiMaggio maintained a daily journal as a coping mechanism to manage the significant emotional strain and psychological impact of his investigations.

He recounted an emotionally scarring visit to an ICU where a friend's son was dying, an experience that resonated deeply with the destructive nature of cyberattacks.

The LockBit attack on a children's hospital particularly triggered intense feelings of rage and vengeance, reinforcing his belief in the necessity of therapy for individuals working in high-stress, dangerous fields like cyber-investigation.

DiMaggio explained that cybercriminals face constant vigilance, severe travel restrictions, and often end up controlled by intelligence agencies or used as scapegoats.

Law enforcement agencies globally actively pursue these individuals, making it exceedingly difficult for them to safely access or spend their illicit financial gains.

Cybercriminals also accrue numerous enemies, including other criminal elements who frequently target them, complicating their existence within the underworld.

Blockchain tracing has significantly reduced the anonymity of Bitcoin transactions, making it harder for cybercriminals to hide their illicit gains.

DiMaggio noted that hackers often get apprehended during the money-laundering phase, as proficiency in hacking does not translate to skill in financial obfuscation, and those offering to help with laundering are frequently intelligence operatives who ultimately control the criminals' autonomy.

DiMaggio issued a strong warning against inexperienced individuals attempting to infiltrate criminal communities, emphasizing the lethal risks involved.

He clarified that the glamorous portrayal of cyber-investigation in popular media drastically misrepresents the life-threatening realities of engaging with high-level cybercriminals.

DiMaggio strongly advised against amateurs engaging with malicious actors due to the extreme personal danger, recommending instead that aspiring investigators seek formal training through government organizations or reputable sources like SANS.

He stressed that the often-glamorous depiction of intelligence work in movies is far removed from the perilous and demanding reality of the field, where one's entire life can be irrevocably altered by involvement.

DiMaggio founded Arkham Cyber with the goal of transitioning his unique experience from active infiltration into providing professional advisory services.

He aims to leverage his specialized expertise to assist executives, CTI teams, and companies in effectively handling and defending against ransomware threats.

In the future, DiMaggio plans to launch a dedicated training course to professionally teach the intricate craft of infiltration, thereby extending his knowledge to a new generation of cybersecurity professionals.

DiMaggio likened his unique position in cybersecurity to that of a lawyer who understands both the legal system and its judges, possessing knowledge of cybercriminals, law enforcement, and the broader cybersecurity community.

He positions himself as a critical liaison capable of bridging these three disparate worlds, intending to proactively assist organizations in navigating and mitigating ransomware crises before they escalate, rather than merely reacting after an attack occurs.