Most cybersecurity stories follow a familiar shape: an organisation gets breached, the response team scrambles, and everyone learns a hard lesson after the damage is done. This episode of the NEVERHACK Cybercast flips that script entirely. It’s the story of an analyst who decided not to wait — and who proved that a single curious person, armed with basic skills and good operational discipline, can knock a ransomware gang offline.
Host Britta Sillaots and co-host Louis Zezeran are joined by Cristian Sindile, a SOC analyst in NEVERHACK’s Security Operations Centre, to dig into the research behind his BSides London 2025 presentation on disrupting the Medusa ransomware gang. What unfolds is part detective story, part masterclass in offensive cyber threat intelligence, and part honest reckoning with the risks of doing this kind of work.
The origin of the investigation is almost comically mundane. While recovering in hospital with a broken leg, Cristian found himself wondering how healthcare providers protect themselves from cyberattacks. That question led him to a troubling discovery: while many ransomware crews follow a self-imposed code — no hospitals, no schools, no children’s or cancer facilities — the Medusa operation observed no such limits. They would attack anyone with money to pay.
For Cristian, that made them exactly the kind of target worth investigating. And as he dug in, the picture grew more complex. There wasn’t one Medusa, but three groups sharing variations of the name — one focused on infostealers, one on ransomware, one on tooling. Together they covered the full criminal “trifecta”: initial access, extortion, and the tools to enable both. All three, researchers had found, traced back to a single crew that had been operating for years before splitting apart — a lineage that reportedly ran through an earlier stealer operation and a botnet group before arriving at its current form.
The breakthrough came from a flaw so basic it borders on embarrassing. One of the gang’s leak sites — the blog where they dumped the data of victims who refused to pay the ransom — was built on WordPress and hosted as a Tor hidden service. Crucially, the operators had never disabled WordPress’s xmlrpc.php pingback function, a legitimate debugging feature.
By sending a crafted request, Cristian got the site to “ping back” — not over Tor, but from its true IP address, which turned out to be in Russia. As Britta notes in the episode, disabling XML-RPC is one of the first things any WordPress hardening guide recommends, which makes the oversight all the more striking. It’s a powerful reminder that even sophisticated criminal operations make the same mistakes as everyone else.
Because the same infrastructure hosted both the leak blog and the negotiation portal, that single exposure cascaded. Law enforcement gained access not only to the data queued for publication, but to live ransom negotiations, exact payment sums, and Bitcoin addresses. From there, the servers were taken offline — then again after they came back — until the gang eventually rebuilt their platform from scratch, abandoning WordPress and open-source tooling, and returned at roughly half their former capacity.
The aftermath reads like a thriller. Shortly afterward, news emerged that Russia’s FSB had arrested a Medusa-linked stealer group — reportedly after they attacked a hospital deep inside Russia, a serious taboo for actors operating from Russian soil. Pressure from the exposure appears to have forced the three splintered groups to consolidate operations under a single banner to manage the crisis.
Cristian is refreshingly honest about attribution. He can’t say for certain whether his actions triggered the arrests, or whether a rival group — which leaked over a year of the gang’s internal chat logs in retaliation for unpaid debts — was the decisive factor. But the broader point stands: roughly ten minutes of work from someone with a red-team mindset and a threat-intelligence approach helped disrupt not one ransomware operation, but three.
The most valuable section of the episode isn’t the takedown — it’s the tradecraft. Cristian breaks down how analysts can operate inside criminal communities without ever crossing legal lines.
The OPSEC fundamentals are non-negotiable: use Tails to protect your real IP, build a credible sock-puppet persona, stick to TOR, never use personal or company funds, and — most importantly — assume you are already compromised and act accordingly.
But the deeper insight is psychological. Threat actors, Cristian explains, are people with the same desires and fears as anyone else, and their shared fear is law enforcement. You don’t infiltrate a forum by hacking it; you infiltrate it by becoming genuinely useful. Post about OPSEC. Share technical knowledge. Call out groups that break the community’s rules. Done well — and entirely legally — this builds reputation. Over months, that reputation can earn moderator privileges, at which point new threat actors trust you by default and come to you for help fixing their broken tools. Suddenly an analyst has a complete picture of a gang’s toolkit, TTPs, and IOCs — handed over voluntarily, for free.
Co-host Louis Zezeran connects this to leadership principles he’s taught in a very different context: the first law of building relationships is to provide support. The same human dynamics that build trust in a team build trust in a criminal forum.
A recurring theme is how unglamorous these operations really are. People imagine the dark web as a shadowy world of criminal geniuses. The reality, as Cristian and Louis agree, is closer to a reality TV show — egos, rivalries, infighting, and groups that fracture and reassemble around personal grievances. That very dysfunction is what creates the opening to infiltrate and exploit them. The same fragmentation that makes these crews hard to pin down also makes them vulnerable.
The hosts don’t let the heroics go unchallenged. Louis presses on the real-world danger: when you interrupt someone’s income stream, could you provoke retaliation that spills into the physical world? Cristian acknowledges the risk is real — pointing to cases of online recruitment for real-world violence — and stresses that personal risk tolerance is something every analyst must weigh for themselves. Operating under a company like NEVERHACK, or alongside law enforcement, provides a crucial layer of protection that lone operators lack.
That distinction is central. Is this vigilantism? Cristian’s answer is clear: not if you work with law enforcement. The entire value of the approach depends on responsible disclosure and collaboration — reporting findings to the right authority based on jurisdiction, whether that’s a national CERT, Interpol, or the FBI. Acting alone, outside that framework, helps no one and exposes the analyst to real liability.
Cristian’s closing argument is a call to the wider community. Most CTI today is defensive — focused on IOCs and an organisation’s own risk posture. But if more analysts spent even a little time properly investigating threat actors and applying offensive security principles responsibly, the field could make a serious dent in the cybercrime economy. For a hospital or any likely target, exposing an attacker’s infrastructure before an attack can be cheaper and more effective than cleaning up afterward.
This is a rare, honest, ground-level look at how individual initiative, basic technical insight, and disciplined OPSEC can disrupt organised cybercrime — and the ethical guardrails that keep it on the right side of the law.
Listen to the full episode now, and if it resonates, subscribe to the NEVERHACK Cybercast on your favourite podcast platform and share it on social media. Got a topic you’d like us to cover? Email us at [email protected].
Netskope aitab muuta nähtamatud riskid nähtavaks Pilveteenused, SaaS-rakendused ja tehisintellekt on saanud meie igapäevase töö oluliseks osaks. Küsimus ei ole enam isegi selles, kas töötajad neid kasutavad, vaid selles, kas organisatsioon suudab seda kasutust turvaliselt omaltpoolt juhtida. Täna on võimalik töötada kõikjal- kontoris, kodus, kliendi juures ja liikvel olles. Andmed liiguvad Microsoft 365, Google Workspace’i, […]
Eesti tööstusettevõtted on viimastel aastatel teinud suure arenguhüppe. Automatiseeritud tootmisliinid, ühendatud seadmed, pilveteenused ja digitaliseeritud tarneahelad aitavad tõsta efektiivsust ning konkurentsivõimet. Kuid mida rohkem sõltub tootmine digitaalsest taristust, seda suuremaks muutub ka küberturvalisuse roll. Neverhack Estonia juhatuse liikme Rita Käit’i sõnul ei ole Eesti tööstusettevõtete suurim väljakutse enam tehnoloogia puudumine, vaid tervikpildi puudumine. „Paljud ettevõtted […]
Suurem sooline tasakaal juhtimises annab ka meestele võimaluse pääseda peaaegu kohustuslikust tugeva otsustaja rollist, kirjutab küberturbeettevõtte Neverhack Estonia juhatuse liige Rita Käit. Eesti börsiettevõtted peavad vastavalt eurodirektiivile juuni lõpuks suurendama soolist tasakaalu oma juhtimises. Suuremast soolisest tasakaalust ettevõtete juhtimises räägitakse sageli kui naiste võimalusest jõuda õiglasemal ja lihtsamal viisil otsustajate sekka. See on kahtlemata oluline, […]
