When RansomHub, one of the most prolific ransomware groups, vanished overnight back in April, it sent shockwaves through the cybercriminal underworld. With over 600 global attacks and millions extorted, their sudden disappearance left affiliates scrambling and researchers asking: what happened?

Join Group-IB’s Gary Ruddell and Nick Palmer as they speak with Pietro Albuquerque, a threat intelligence analyst at Group-IB and a leading expert on RansomHub, to unpack the rise and fall of this ransomware cartel. They explore how RansomHub’s affiliate-friendly model disrupted the RaaS market, why its tactics proved so effective, and where its members may have gone.

From double extortion to underground job markets, this episode reveals the hidden mechanics of ransomware operations and what businesses must do to stay ahead of the next wave.

By understanding who these actors are and how they operate, you can better anticipate threats and protect yourself in an increasingly hostile digital world.

Subscribe now to meet these Masked Actors — and stay one step ahead in the fight against cybercrime.

Episode links:
Group-IB's Top 10 Masked Actors

RansomHub ransomware-as-a-service

RansomHub Never Sleeps: The evolution of modern ransomware

Ransomware debris: an analysis of the RansomHub operation

Ransom notes from the most active groups

Meet Group-IB's top 10 Masked Actors here - and stay one step ahead in the fight against cybercrime.

Empty shelves, lost customers, and hundreds of millions of pounds in lost profit are just some of the outcomes that retailers have faced in the wake of recent ransomware attacks. From the Co-operative to M&S, the recent cyber attacks on UK retail giants have dominated headlines and wreaked havoc that’s been felt by customers, staff, and government officials alike. 

The culprits behind it? A highly organised group of ransomware specialists, codename: DragonForce. 

Join Group-IB’s Gary Ruddell and Nick Palmer as they speak with Jason Rebholz, an expert on the ransomware ecosystem, with over a decade of experience performing forensic investigations into complex cyberattacks. 

In this episode, they unpack how DragonForce evolved into a ransomware cartel, franchising their malware to affiliates like Scattered Spider, whose sophisticated social engineering tactics have significantly disrupted UK retail. They explore the wide-ranging impact on both businesses and consumers, offering insights into how each can better protect themselves. Finally, they examine the role of policy and regulation in preventing future attacks and strengthening cyber resilience.

By understanding who these actors are and how they operate, you can better anticipate threats and protect yourself in an increasingly hostile digital world.

Subscribe now to meet these Masked Actors — and stay one step ahead in the fight against cybercrime.

Episode links:
Group-IB's Top 10 Masked Actors

Inside the Dragon: DragonForce Ransomware Group

Meet Group-IB's top 10 Masked Actors here - and stay one step ahead in the fight against cybercrime.

In December 2014, Sony Pictures announced they were cancelling the release of Seth Rogan’s newest venture The Interview due to a large-scale cyberattack. And in February of this year, global cryptocurrency exchange Bybit suffered a massive attack resulting in the theft of $1.5 billion. 

These masked actors are still active. But now, they’ve turned their attention to companies like yours...

Join Group-IB’s Gary Ruddell and Nick Palmer as they speak with Geoff White, one of the worlds leading journalists covering organized crime and tech and the author of The Lazarus Heist – From Hollywood to High Finance: Inside North Korea’s Global Cyber War as they explore the infamous Lazarus group.

In this episode, they delve into the groups’ latest modus operandi – infiltration campaigns, whereby North Korean hackers pose as remote IT employees to funnel information through the backdoor and leave logic bombs in code that they can trigger years or months down the line. They look at how this shifts the responsibility model for cybersecurity, requiring vigilance from across the organisation for unusual behaviour.

By understanding who these actors are and how they operate, you can better anticipate threats and protect yourself in an increasingly hostile digital world.

Subscribe now to meet these Masked Actors — and stay one step ahead in the fight against cybercrime.

Episode links:
Group-IB's Top 10 Masked Actors
Lazarus Arisen: Architecture, Tools and Attribution
Stealthy Attributes of Lazarus APT Group: Evading Detection with Extended Attributes
APT Lazarus: Eager Crypto Beavers, Video calls and Games

Meet Group-IB's top 10 Masked Actors here - and stay one step ahead in the fight against cybercrime.

If a cybercriminal steals your password, you can change it. But what happens if they steal your face? 

Former soldier turned hacker, Gary Ruddell and financial crime veteran, Nick Palmer, explore the actors behind GoldFactory - a cybercriminal group stealing users' facial recognition data to clean out victims bank accounts.

Joined by Craig Jones, who spent five years at Interpol as the director of cybercrime, Group-IB's Gary and Nick explore how masked actors are exploiting AI and Deepfakes for financial gain. 

In this episode, they dig into the novel tactics of this Chinese-speaking group who created a first of its kind iOS trojan to steal biometric data and bypass banking facial recognition security systems. Together they unpick how cybercriminals are adopting new technologies and franchising their efforts to manipulate more victims and increase their payoff.

By understanding who these actors are and how they operate, you can better anticipate threats and protect yourself in an increasingly hostile digital world.

Subscribe now to meet these Masked Actors — and stay one step ahead in the fight against cybercrime.

Episode links:
Group-IB's Top 10 Masked Actors
Face Off: Group-IB identifies first iOS trojan stealing facial recognition data
Gold Rush is back to APAC: Group-IB unveils first iOS trojan stealing your face

Meet Group-IB's top 10 Masked Actors here - and stay one step ahead in the fight against cybercrime.

Welcome to Masked Actors — a true crime-inspired podcast from Group-IB that brings you face to face with the people orchestrating some of the most sophisticated cyberattacks on the planet. 

Join hosts Gary Ruddell — former soldier turned hacker and cyber threat expert — and Nick Palmer, a financial crime veteran, for the gripping new series which uncovers the tactics, motivations and real-world impact of the top 10 most prolific cybercriminal organizations of 2025.

By understanding who these actors are and how they operate, you can better anticipate threats and protect yourself in an increasingly hostile digital world.

Subscribe now to meet these Masked Actors — and stay one step ahead in the fight against cybercrime.

Meet Group-IB's top 10 Masked Actors here - and stay one step ahead in the fight against cybercrime.