How a cybersecurity researcher befriended, then doxed, the leader of LockBit ransomware gang

In a detailed exposé at Def Con, cybersecurity researcher Jon DiMaggio revealed his undercover efforts to infiltrate and unmask the notorious ransomware gang LockBit. Earlier this year, international law enforcement agencies had temporarily disrupted LockBit’s operations, seizing their dark web site. After the gang quickly rebounded, DiMaggio shared his two-year effort to unearth the identity of LockBit’s administrator, who he identified as Dmitry Khoroshev. Employing sockpuppet accounts and gaining the trust of LockBit’s leader, DiMaggio infiltrated the group’s operations. This culminated in a coordinated reveal by DiMaggio and the U.S. Department of Justice, putting a spotlight on Khoroshev and marking a significant milestone in cybercrime investigations. DiMaggio’s work emphasizes the risks and intricacies involved in cybercrime research and the potential consequences for those who infiltrate criminal networks.

Opens on TechCrunch