The Cyber Insider

The episode delivers concrete insights about LockBit's operational structure, the impact of sanctions, and law enforcement's shift to psychological operations. However, it relies heavily on anecdotes and personal narrative rather than systematic analysis. The discussion of ransomware-as-a-service, affiliate economics, and the limitations of law enforcement resourcing are substantive, but padding and throat-clearing dilute the density throughout.

“LockBit started in 2019. They learned quickly that a brand name makes a difference.”

“with sanctions, at least in the US, victims will not be able to pay anyone affiliated with LockBit unless the government makes an exception”

The episode covers well-trodden ground in cybersecurity discourse - law enforcement disruptions, ransomware-as-a-service models, and resource constraints. The contrarian take on ransomware bans and the insight about law enforcement using psychological operations show some original thinking, but the core framing and frameworks are conventional. The personal relationship with Dmitry adds narrative color but not conceptual originality.

“I would do a straight up ransomware ban. There are companies that would go under and fold...it would be like ripping off a band aid and hemorrhaging out”

“the person I've been talking to is so much more low key than that...that's literally a persona he has pushed”

Jon DiMaggio is a genuinely credentialed practitioner with direct investigative experience on LockBit, demonstrated law enforcement collaboration, published reports, media presence (NYT, WIRED), and a SANS award. His direct interaction with threat actors and involvement in law enforcement operations positions him at the top tier of guest quality for this domain. He speaks from active investigation, not retrospective commentary.

“Jon is the chief security strategist at Analyst1 and a specialist in investigating enterprise ransomware attacks”

“He's exposed the criminal cartels behind major ransomware attacks, aided law enforcement agencies and federal indictments of nation state attacks”

The episode cites specific victims (Boeing, SpaceX, Royal Mail, Entrust, China-based bank), names the identified leader (Dmitry Khoroshev), and references concrete law enforcement actions (Operation Kronos, NCA disruption, May takedown, sanctions). However, quantitative data is sparse - no numbers on attack volumes, ransom amounts, affiliate counts, or comparative timelines. The discussion often retreats to generalization after initial specifics.

“They were behind...Within trust. They have targeted large defense contractors like Boeing...they took that one of their US branches down”

“I had the guy's name, his phone number, his passport, his address, I knew where he lived”

The hosts ask competent follow-up questions about group structure, impact of sanctions, and affiliate reach. However, questioning lacks edge - few challenges to DiMaggio's assertions, limited pushback on solutions proposed, and minimal pressure on vague claims (e.g., "lost some employee partners" without numbers). The interview reads more as friendly extraction of narrative than rigorous interrogation. Brett's question about the criticisms of psyops shows willingness to surface tension, but resolution is soft.

“What impact do you think that will...[incomplete thought]”

“The National Crime Agency also released a list of affiliates. First names and last names in some cases. And some of those names were not Russian. They sounded quite western, if they're real, of course.”