Inside LockBit: How He Earned a Ransomware Gang’s Trust

Overview

The video is an interview about John (a former ransomware/dark-web research participant) and his experiences profiling cybercriminals—especially LockBit. It also covers lessons about mental health, the consequences of cybercrime, and how “Cybercrime Intelligence” (CTI) should be conducted safely and professionally.

How John gained LockBit’s trust (and why it backfired)

• John describes creating a fake online identity and attempting to join a ransomware group to conduct profiling. He ultimately claims he joined LockBit.
• He says he published a report with his name on it, and soon after, LockBit uploaded a spoofed avatar using his face.
• Despite this, the group initially responded favorably, calling him a “favorite researcher.”
• John states the interaction lasted about 1.5 years, during which he says the reality behind the groups’ actions—especially targeting vulnerable victims—was far worse than what typical interviews show.

Mental health and personal fallout

• After LockBit leadership was indicted and their information spread, John says his photo was released, and he received death threats.
• He frames the impact as a major mental health burden for himself and his family, and says his personal life became difficult.
• John also states he has stayed largely unmarried due to the intensity and danger.
• He connects these experiences to the book’s emotional framing (e.g., “hatred/anger/revenge”), arguing that public reporting rarely addresses the human/psychological cost of these investigations.

Cooperation with law enforcement

• John says “we” worked with the FBI and the NCA (National Crime Agency), especially after key legal actions (indictments).
• He emphasizes that law enforcement pressure—and the danger of retaliation after public exposure—can escalate risks for researchers.

A detailed story: involvement of REvil and the Kaseya attack aftermath

One of John’s “favorite” stories in the book centers on REvil and a young figure allegedly tied to election hacking and later ransomware:

• John describes how the person was manipulated or threatened by higher-ups connected to criminal networks that may have had intelligence links, forcing him toward further wrongdoing.
• He recounts that the individual contacted the FBI with information involving election-hacking conversations, and that the FBI reportedly did not respond immediately.
• John then narrates how the Kaseya ransomware operation (linked to REvil) was planned and executed—described as remotely “handing over a mechanism/button.”
• He claims the operation caused widespread impact, affecting thousands of customers and over 1,500 institutions worldwide, including hospitals, schools, government agencies, and retail.
• The ransom demand is described as $70 million, but John claims it was not paid.
• John says the incident drove policy changes, claiming Joe Biden elevated ransomware as a national security matter and broadened the U.S. response to include agencies such as the CIA and NSA.
• He also describes the later trial outcome as severe (e.g., years in prison and large restitution/damages figures presented in the video).
• He contrasts this with the idea that other leadership figures disappeared, implying a possible “cash-out” and escape.

Advice to young people attracted to cybercrime

John argues that:

• Cybercrime is often driven by peer pressure and the illusion that it’s “cool.”
• The real costs are ongoing and severe, including:
  • constant fear
  • inability to travel normally
  • being monitored
  • threats to family
  • scapegoating
  • arrest and imprisonment
  • even difficulties spending money
• Bitcoin is traceable, and “anonymity” is no longer guaranteed—suggesting criminals often get caught during laundering or tracing.
• Criminals may become controlled by more powerful backers (framed as intelligence-linked networks), losing freedom long-term.

“Don’t talk to bad guys”: CTI vs. naïve infiltration

• John says many people romanticize his work (talking to villains), but should not imitate it.
• He claims his actions were enabled by 14 years of secret intelligence/government training, including careful planning, profiling, and controlled methods designed to extract information safely.
• He argues untrained people attempting direct contact could “self-destruct” or even die, emphasizing his own anxiety and security measures.

Product/personal brand: Arkham Cyber and secure preparedness

• John promotes Arkham Cyber, offering advisory services for executives, CTI teams, and organizations.
• He positions this as a bridge between cybercriminals, law enforcement, and the broader security community.
• He ties Arkham Cyber to ransomware preparedness, arguing organizations shouldn’t wait until an attack happens—covering decisions like insurance/red-team response and “who represents the organization” after an incident.

Presenters / Contributors

• David Bombal — interviewer / host
• John DeMaszio — guest; author; cybersecurity/CTI researcher
• Unspecified “Proton Drive” sponsor/mention — product endorsement within the video transcript (no individual credited)