Vigilante, Hero, Or Both?

The recent case of a cybersecurity researcher who infiltrated and exposed the leader of the Lockbit ransomware gang raises profound questions about the future of cyber defense. Is this the dawn of a new era where cyber researchers become the front-line vigilantes, taking justice into their own hands?

In this episode of The Other Side of the Firewall, Ryan Williams Sr. , Shannon Tynes, and Daniel Acevedo dive into the fascinating story of how a cybersecurity researcher befriended and then doxxed the leader of one of the most notorious ransomware gangs. This story, initially reported by Lorenzo Franceschi-Bicchierai of TechCrunch, highlights both the potential and the perils of such an approach.

The Researcher’s Approach: A New Kind of Cyber Spy Game

As we discussed, the researcher’s tactic was to gain the trust of the ransomware gang leader, only to turn around and expose them publicly. While this approach led to the temporary disruption of the gang's operations, it also raises critical ethical and practical questions. Is this the future of combating cybercrime? Could this method become a common practice among cybersecurity professionals, or is it too risky to replicate?

Daniel, one of my co-hosts, pointed out the danger involved: "This is very dangerous. He’s a researcher, but he’s making enemies with some of the most skilled cybercriminals out there. I couldn’t sleep if I were him."

Vigilante or Cybersecurity Professional?

There's a thin line between cybersecurity research and vigilantism. The researcher in question coordinated with law enforcement before going public, but the risks are still immense. Shannon drew an interesting parallel, comparing this researcher to reporters who uncover dangerous truths: "They know the risk going in. They know what they're signing up for."

In the end, the researcher managed to slow down the gang’s operations, though they were back online quickly. This raises the question: is it worth the risk? Or are we better off leaving such operations to official law enforcement agencies?

Conclusion

As we see more of these stories emerge, it will be interesting to watch how the cybersecurity community and legal frameworks evolve to address the growing overlap between cyber defense and direct action. The key takeaway here is that while this method may work, it is fraught with risks and ethical dilemmas. We might just be witnessing the birth of a new kind of cybersecurity professional—one who is part researcher, part vigilante.

Thank you for reading and stay tuned for more episodes of The Other Side of the Firewall podcast on Monday, Tuesday, Wednesday, and Fridays, as well as, the Ask A CISSP podcast every Thursday. Please like, share, and, subscribe.

Stay safe, stay secure!

Ryan is a retired Air Force veteran who brings over 20 years of experience in network infrastructure, project management, and cybersecurity consulting to his current role at BuddoBot. Buddobot's mission is to support national security by transforming, empowering, and educating organizations to shift from reactive, diluted, automated, and high-cost IT and security practices to proactive, effective solutions that fortify their security.

Shannon, also a retired Air Force veteran, has more than two decades of expertise in network security and vulnerability management. He now serves as an Information System Security Officer (ISSO) for the U.S. Space Force, where he continues to enhance national security protocols.

Chris, a Navy veteran with over ten years in IT, information assurance, and risk management, currently works at CompliancePoint. His roles include vCISO, RMF assessor, and consultant, focusing on enhancing data security and privacy for various organizations.

Daniel is an Air Force veteran with over 15 years of combined experience in IT, cybersecurity, information assurance, and government risk compliance. He has held various roles, including IT administrator, cybersecurity engineer, senior information system security manager, and currently serves as a senior security consultant for Booz Allen Hamilton. In this latest role, Daniel leverages his expertise to address unique and complex challenges in the cyber and IT domains, enhancing his customers' capabilities.