DEF CON 32 - Behind Enemy Lines: Going undercover to breach LockBit Ransomware Op- Jon DiMaggio

The speaker recounts a prolonged, emotionally charged relationship with Lockbit, a notorious ransomware operator, revealing the human side of cybercriminals through personal engagement, psychological rapport, and ethical dilemmas. This story blends cyber espionage, personal connection, and moral reflection, culminating in the public exposure of Lockbit’s identity.

• The speaker used sock puppets and social engineering to build trust with Lockbit by engaging him in online forums and conversations with his affiliates [1:52–3:37].
• Through deep conversations with affiliates and fellow criminals, the speaker profiled Lockbit’s personality, values, and habits, forming a nuanced understanding of his inner life [4:00–5:01].
• The speaker gained access to Lockbit’s private communications, including a photo and a handwritten note, to build emotional rapport and demonstrate authenticity [17:34–18:07].
• Lockbit publicly acknowledged the speaker’s work, calling them “the best researcher,” signaling a genuine, unexpected personal connection [14:53–15:00].
• The relationship soured when Lockbit was discovered to be emotionally involved with another person, and FBI intervention revealed the extent of his criminal operations [24:36–25:18].
• The speaker exposed Lockbit’s true identity through a detailed investigation, leveraging a network of contacts and public disclosures, culminating in a Defcon talk that publicly revealed his identity [32:13–35:59].

The story ends with a reflection on the emotional toll and ethical boundaries of such a relationship, emphasizing that while driven by curiosity and storytelling, it also revealed the humanity behind a feared cybercriminal.

Sources:

• 1:52–3:37 Profiled Lockbit’s online presence and used sock puppets to gain access.
• 4:00–5:01 Detailed how the speaker built a personality profile of Lockbit through affiliate inte