When the Hunter Becomes the Hunted: The Art and Risk of Threat Actor Engagement

Introduction

The way researchers interact with threat actors has undergone significant changes over the years. Historically, well-established practices included both direct and indirect engagement. Researchers either engage directly with threat actors by using fake personas to build trust and gather intelligence, or observe them passively without interaction, monitoring discussions on hacker forums, DarkWeb forums, or private messaging platforms such as Telegram. Regardless of the chosen approach, analysts exercise strict operational security (OPSEC) measures to conceal their real identities and safeguard both themselves and their organizations from potential retaliation or exposure.

Today, however, the landscape of threat actor engagement has shifted dramatically. In some cases, researchers and threat actors now communicate openly, sometimes even on highly visible public platforms such as social media, which introduces a new and complex dynamic to threat intelligence work. Researchers may willingly engage in conversations with threat actors as part of their investigations. In contrast, in other situations, threat actors initiate one-sided interactions, attempting to intimidate, harass, or even threaten researchers, both publicly and privately. What was once a highly controlled and secretive practice has become increasingly exposed, unpredictable, and, in some cases, dangerous for those involved in conducting investigations.

In this research, we will explore the current state of threat actor engagement practices and examine how these evolving interactions are shaping modern threat research. This includes analysis based on our proprietary information, my own experience, as well as insights from an interview with Jon DiMaggio, who is known for mastering overt threat actor engagement.

Traditional Threat Actor Engagement Practices & Threat Actors’ Responses

Established threat actor engagement practices in the threat intelligence field are particularly drawn from methodologies rooted in Human Intelligence (HUMINT). Historically, threat actor engagement includes both direct and indirect communication.

In direct engagement, a researcher interacts personally with the adversary to collect information. Such engagement requires a variety of skills, including language and cultural awareness, depending on the origin of the actor. Despite the high rewards of direct engagement, such as gaining real-time intelligence and early warnings, it also comes with significant risks. Conducting undercover operations using decoy identities (also known as “sock puppets”) requires not only strong OPSEC but also legal oversight to ensure compliance with relevant laws and regulations. Communication with threat actors may be established through various channels, including:

• DarkWeb forums
• Encrypted chats (Telegram, Jabber)
• Ransomware negotiation portals (posing as victims or negotiators)
• Affiliate recruitment channels
• Infiltrating invite-only criminal marketplaces and chats

In indirect engagement, a researcher collects intelligence through intermediary means or passive observation without direct interaction. Compared to direct engagement, indirect engagement carries lower risk and is often legally safer. However, proper OPSEC measures are still necessary to avoid detection. In terms of intelligence quality, indirect engagement may produce slower or more limited insights, and sometimes the information may be less actionable without additional corroboration. Indirect engagement practices include:

• Monitoring DarkWeb forums and marketplaces passively
• Scraping leaked databases, malware samples, or data dumps
• Analyzing TTPs from malware telemetry or honeypot activity
• Reviewing social media

From the actors’ side, they have always been attentive and remain on high alert to the potential presence of researchers within their world. Forum administrators, for example, take precautions to shield their communities and prevent infiltration, making it more difficult for researchers to stay and monitor activity inside these spaces. This is especially evident on Russian-speaking forums, where special attention has often been paid to detecting English-speaking users, with particular suspicion directed towards those from North America.

A notable example of these defensive measures emerged with the launch of the RAMP forum, dedicated to ransomware activity, on July 11, 2021. Access to RAMP was strictly controlled. To register, new members were required to prove they had an active account on other well-established forums such as Exploit or XSS. The minimum requirements included having an account older than two months, at least 10 forum posts, and a positive reputation score. These measures were intentionally designed to create high entry barriers for outsiders and make infiltration by researchers or law enforcement significantly more challenging.

On August 18, 2021, an administrator under the moniker “Orange” later identified as Mikhail Matveev, posted a message on the RAMP forum. In the message, he attached a link to an article published by a researcher, pointing out that researchers had already infiltrated the forum and were actively collecting information. He noted that it is probably impossible to have 100% protection against them, referring to the researchers. He also mentioned that filtering is challenging because not all English-speaking users are necessarily researchers or members of the media, but could also be individuals from Brazil or Europe, who are known for selling exploits. In addition to these countries, some Chinese nationals were also expected to join, who would likely use English as their primary communication language.

Later, on September 18, 2021, Orange provided an update, announcing the launch of a private section on the forum to create a safer space for communication, with different levels of access. The primary admission requirement for entry into the private section was being a Russian-speaking member.

While these efforts toward active exclusion make sense from the actors’ perspective as a way to shield their illicit activities from outside scrutiny, they have long contradicted their strong interest in researchers and the media, as well as their frequent willingness to engage in open communication. In the next section, let’s examine the roots of overt engagement and how things are unfolding today. As traditional boundaries between researchers and threat actors have evolved, new forms of interaction have emerged, ranging from collaborative to confrontational and entirely unpredictable. To better understand how the current landscape has evolved, it is essential to examine the factors that have led to this shift, the motivations driving both sides, and the increasing role of public engagement in modern threat intelligence.

Talking to the Enemy: A New Frontier in Threat Intelligence

On June 17, 2024, I opened my Twitter account and discovered a warning message from a well-known threat actor, USDoD: “people think u are the onwer from BF now because both had same name, if I was u I would do a statement before people start target u.” (all grammar preserved). The warning came after one of the administrators of Breach Forums, ShinyHunters, following another shutdown of the forum, posted a message naming a new owner of Breach Forums as Anastasia. This sparked conversations, with several people reaching out to me with questions.

USDoD was one of them. The actor became known for targeting multiple infrastructure, as well as for maintaining a strong presence on Twitter and being open to communication with both media and researchers. Later, in August, USDoD was doxxed by CrowdStrike and identified as a 33-year-old man named Luan BG, who lives in Minas Gerais, Brazil, followed by his arrest in October.

I had never spoken to USDoD before. Of course, I was aware of his existence and activities. My interactions with him were limited to indirect engagement, observing, and collecting intelligence from the platforms and spaces where he was active. Apparently, the US DoD was also aware of my existence and had been monitoring my activity as well. That wasn’t a total surprise, and it wasn’t the first time threat actors had reached out to me. If you are a researcher, the likelihood of threat actors monitoring and attempting to contact you is high, especially if you have a presence on social media, regardless of whether you are open to engaging with them or not.

These instances of actors taunting and communicating with researchers and the media have been happening for years. Actors hiding behind their monikers have various reasons and motivations for doing so, ranging from strategic communication to simply seeking some form of human connection as an escape from the isolated world they operate in, or, in worse cases, to intentionally cause harm.

The major shift toward overt interactions between threat actors and researchers began approximately six years ago. Ransomware actors, in particular, have become some of the most vocal, though in the early days, they largely avoided public communication. That changed in November 2019, when the Maze syndicate opened a Pandora’s box by launching a data leak site.

Lawrence Abrams of BleepingComputer, who has undoubtedly become one of the most frequently mentioned security reporters by ransomware actors, recalled in a November 2019 article the first time he was contacted directly by members of the Maze group, one of the most prominent ransomware groups at the time. “Last Friday at 6:35 PM EST, as I was finishing for the day, I received an email from a known email address utilized by the Maze Ransomware,” Abrams wrote, publishing the email that was sent by the actors. At the time, Maze was actively conducting an attack against a billion-dollar company. In the email, the actors stated: “They were asked to pay ransom in order to get the decryptor and be safe from data leakage. We have also told them that we would write to you about this situation if they don’t pay us, because it is a shame for the security firm to get breached and ransomwared.”

Maze actors weren’t just acting out of boredom; their moves were highly strategic and timed to coincide with the launch of their data leak site later in November 2019. Maze’s pioneering of the double extortion tactic through the introduction of data leak sites was a deliberate strategy to create chaos, increase pressure on victims, and draw public attention. Establishing communication with one of the most well-known and reputable cybersecurity media figures, Lawrence Abrams of BleepingComputer, was a deliberate decision aimed at maximizing visibility and impact.

In addition to serving as a core element of the double extortion model, data leak sites have evolved into one of the primary channels of communication used by ransomware groups for strategic messaging and psychological pressure. Beyond coercing victims, these platforms are also used to influence the broader cybersecurity ecosystem, including industry professionals, the media, and even law enforcement. Ransomware groups often attempt to manipulate public narratives, discredit security researchers, intimidate organizations, and provoke authorities through carefully crafted threats and public statements, all designed to maximize their leverage, expand visibility, and sustain their criminal operations.

While most of the messaging on these leak sites is aimed directly at victims, common tactics include:

1. Attributing blame to victims by publicly highlighting perceived weaknesses or failures in their cybersecurity posture as justification for the attack.
2. Targeting individuals associated with the victims, either through direct contact or by exposing their personal information, to increase pressure and improve the chances of ransom payment.

You can read more about these and other tactics used by threat actors in our previously published report.

Over time, threat actors escalated their behavior, moving beyond mere communication to actively targeting researchers and members of the media. One of the examples occurred on September 7, 2021, when RAMP administrator Mikhail Matveev (aka Orange) posted a dump of Fortinet credentials and deliberately attached a photo of Lawrence Abrams. The leaked dataset contained 799 directories and 86,941 allegedly compromised VPN credentials. This data was published simultaneously on both the Groove ransomware data leak site, also operated by Matveev, and the RAMP forum. These Fortinet credentials were likely used to promote Groove ransomware operations and attract new affiliates. Including the names and images of well-known industry figures, such as Lawrence Abrams, was a tactic designed to draw additional attention and seek broader coverage by Western Media.

Additionally, the profile image used by Matveev was taken from Ayesha Prakash’s profile, a female security researcher. Later, in a LinkedIn post, Ayesha suggested that she may have been targeted because of a recent blog post published by her employer that covered RAMP’s activities. This incident reflects a tactic that would become increasingly common in the future: the use of personal images, either on user profiles or as attachments to forum posts, as a means of intimidation or signaling.

This quickly escalating reality of threat actors targeting researchers and media, while also committing serious crimes against their victims, got out of control fast. Actors would talk about researchers and media figures, often sharing their own opinions about the research or articles. As the saying goes, our biggest fans are our haters. It’s clear that many of them develop a kind of connection and become attached to the people they’re watching. While some of this may seem relatively harmless, others take it further and move toward threats or even violence.

That happened in the case of Allison Nixon, a cybersecurity researcher at Unit 221B, who was violently threatened online by an unknown individual operating under the moniker Waifu. “I was not working on him until he started posting threats about me,” she said in an interview with CTVNews.ca. As expected, the individual quickly became a target on the team’s radar. After several months of investigation and in partnership with Mandiant, Waifu was identified as Connor Riley Moucka, a 25-year-old from Kitchener, Ontario. Moucka is currently being held in Canada as he awaits extradition to the United States to face multiple criminal charges. U.S. authorities allege that Moucka and his accomplices hacked into at least 10 organizations, stealing large volumes of sensitive data, including payroll and banking information. By holding this data for ransom, they allegedly extorted USD 2.5 million in Bitcoin from three of their victims.

This unwanted attention from threat actors is a widespread reality in the industry and a significant risk to consider when entering the field. However, while many researchers still choose to avoid direct engagement with threat actors under their real names, others have mastered the art of interacting openly and strategically, turning visibility into a tool rather than a vulnerability. One of those pioneers is Jon DiMaggio. I sat down with Jon to explore his experiences navigating this unconventional and often dangerous space. In the next section, we will take a look behind the curtain into how relationships with cybercriminals are built, maintained, and ultimately leveraged for intelligence.

“Stay safe out there. And if you decide to talk to the enemy, know exactly why you’re doing it.”

In the world of threat intelligence, few topics spark as much debate as the ethics and risks of engaging directly with threat actors. Jon’s first overt engagement began in early 2023, shortly after the publication of The Ransomware Diaries 1, which uncovered the operations of LockBit and other ransomware groups and actors. Soon after, an actor behind the LockBit persona placed Jon’s photo on their profile on the Exploit forum. Rather than shy away, Jon made a bold choice: he reached out directly, as himself.

He expected hostility. Instead, the reply was oddly flattering: “You’re the best researcher. We love you. You are a very handsome man. You look like Bruce Willis.” That response not only broke the ice but set the tone for a surprising level of respect from many Russian-speaking threat actors that he would experience in future interactions.

Over time, Jon has interacted openly with many cybercriminals. While these interactions can sometimes appear engaging or even entertaining on the surface, engaging with threat actors requires a highly cautious and calculated approach to ensure personal and operational safety, he says. The line between information-gathering and exposure is thin, and missteps can have real-world consequences.

The first and most important thing to remember, unlike traditional media interviews, is that you are a researcher, and your primary goal is to gather intelligence. Therefore, every conversation with a threat actor should be approached with a clear strategy and a strong focus on risk management. From the outset, Jon adapts his tone and personality depending on the threat actor he’s engaging with, but he always remains transparent about his ultimate objectives.

“I tell them upfront: I’m a researcher, and I may write about you.”

Surprisingly, most actors are willing to talk under those terms. Some even appear drawn to the notoriety, eager to secure their place in ransomware history. One such example is BassterLord, whose real name, Ivan Kondratiev, was revealed by law enforcement in 2024. He openly admitted his desire for ransomware fame, viewing conversations with Jon as a way to immortalize his name in the cybercrime hall of fame, fully aware that he was being profiled. Beyond ego, other motivations for communicating with researchers can also come into play. Revenge, such as gaining leverage over rival groups; money, particularly in covert operations where financial incentives may be offered; and even loneliness, with some actors simply craving interaction, can all influence their willingness to engage.

Jon noticed something interesting when talking to Russian-speaking threat actors, particularly. Even though there’s political tension between Russia and the United States, many of his Russian contacts were surprisingly friendly, sometimes even more so than people from other regions.

After spending years studying intercultural communication and later applying that knowledge to cybercrime research, I concluded that this dynamic may be linked to the long and complex history between the two countries.

Drawing on ideas from intercultural communication theory by Martin and Nakayama, and an examination of the influence of popular culture, we can gain a better understanding of this concept. Western culture, particularly through Hollywood movies, music, and media, has had a profound influence on Russia and many countries of the former Soviet Union for many years. Due to this, many Russians are familiar with American pop culture and show a strong interest in it. For example, the fact that the threat actor told Jon he looked like Bruce Willis shows how deeply American movies have shaped their cultural imagination and understanding of Western culture.

These kinds of examples show that shared cultural references, even small ones, can help people connect, even if they’re supposed to be on opposite sides. Media and pop culture can make people feel more familiar and less like strangers. So, while a comment like comparing someone to Bruce Willis may seem like a joke, it actually points to something deeper: how culture and media help shape how we see and interact with each other across borders, including cybercriminals who are also humans after all.

That doesn’t mean that all of the interactions are pleasant, Jon said, and there’s no danger. LockBit, for example, once threatened violence against Jon, prompting law enforcement involvement. Others lashed out emotionally when relationships hit bumps, accusing him of abandonment if conversations paused for too long. Yet, even after hostile exchanges, many actors later reached out again, unable to resist the attention and the unique relationship they had built.

This also entails understanding that when overtly engaging with threat actors, researchers should be cautious not to mistake the interaction for a genuine friendship or become overly emotionally invested. Even if actors occasionally “spill the tea” or appear vulnerable, their core intentions remain malicious. Not all information shared in these conversations is reliable, far from it. Groups like RansomedVC, for example, have been known to mix truth with elaborate fabrications. Jon recounted cases where actors completely faked data breaches using AI-generated content to boost their ransom demands and media attention.

However, even in cases where it’s obvious that threat actors are spreading disinformation or misinformation, there’s still value in the interaction. Instead of dismissing these fabrications outright, Jon treats them as data points worth analyzing.

“If you know they’re lying, the question becomes: why are they lying? What’s the goal?”

The next step in the analytical process is to ask: What exactly are they trying to hide? This is where cross-verifying their claims becomes critical. Engaging with other actors connected to the same group, either through fake personas or indirect channels, can help uncover inconsistencies, validate specific details, and ultimately reveal the truth.

For researchers considering overt engagement, Jon offered sobering advice: evaluate the actor’s motives, assess your own risk tolerance, and ensure there is real value in the engagement. “Assume the worst-case scenario,” he warned. “If you can’t stomach it, don’t do it.” If you feel comfortable enough, the recommendations would be as follows:

• Always ask: What does the threat actor want? They never reach out without an agenda.
• Assess the worst-case scenario: Can you handle the fallout if things go sideways?
• Be strategic: Only engage if there’s real research value. Not every conversation is worth the risk.

To summarize different types of threat actor engagement, please refer to the table below:

Conclusion

The evolving landscape of threat actor engagement reflects the broader shifts in cybersecurity, where blurred boundaries, real-world consequences, and human psychology now play as much of a role as code and infrastructure. What was once a hidden and controlled practice conducted strictly behind aliases has increasingly moved into the open, reshaping how researchers and cybercriminals perceive and respond to each other.

As shown throughout this research, the modern threat researcher must navigate a complex reality of ethical considerations, operational risks, and strategic decisions. Indirect, covert engagement remains a foundational method for gathering intelligence safely and effectively. However, direct and overt engagement, while significantly riskier, can provide unique, real-time insights that are otherwise impossible to obtain.

Cases like Jon DiMaggio’s work illustrate that, with proper OPSEC, psychological readiness, and strategic clarity, overt engagement can be a powerful tool, not just for collecting information but for understanding the inner workings, motivations, and vulnerabilities of threat actors themselves.

Ultimately, the decision to engage covertly or overtly should be guided by the research objective, threat landscape, and personal and organizational risk tolerance. As threat actors become more visible and emboldened, researchers must also evolve, striking a balance between visibility and caution, as well as curiosity and discipline. Understanding threat actors as people, rather than faceless adversaries, may be the key to anticipating their moves, undermining their operations, and disrupting their ecosystems from the inside out. Whether opting for indirect monitoring or more direct interaction, it is crucial that these engagements are approached with a high degree of caution, planning, and clear boundaries. Protecting both the individuals conducting the research and the organization itself must remain a top priority throughout the process.

About Analyst1

Threat intelligence teams often struggle to bridge the gap from insight to action. Analyst1 is the Orchestrated Threat Intelligence Platform designed to resolve this issue. It automatically organizes threat data, links it to your assets and vulnerabilities, and customizes views for different roles. Analyst1’s orchestration layer streamlines workflows and automates reliable actions by integrating with SIEM, ticketing, and vulnerability management systems. From Fortune 500 financial institutions to national security agencies, enterprises trust Analyst1 to unify their defenses, significantly reducing their response time from days to minutes.