Masked Actors
True crime meets cybercrime. Discover the people behind the keyboard.From Ransomware-as-a-Service (RaaS) gangs to global financial crime syndicates, the rise of sophisticated cyber threats is reshaping the world. These aren’t lone hackers — they’re organized groups running multi-million dollar operations in the shadows.In the Masked Actors podcast, cyber threat expert and former soldier turned hacker Gary Ruddell joins forces with Nick Palmer, a seasoned financial crime fighter, to investigate the top 10 most dangerous cybercriminal groups of 2025 — drawn from Group-IB’s High-Tech Crime Trends Report.Each episode explores the tactics, motivations, and impact of major cybercrime groups, uncovering their role...
Tycoon 2FA: Is MFA enough when criminals can subscribe to a way around it?
Send us Fan Mail
What separates a market leader from everyone else in the criminal underworld?
Tycoon 2FA is a phishing-as-a-service platform that helps criminals bypass multi-factor authentication and steal credentials. Group-IB research estimates it holds 89% of the adversary-in-the-middle PaaS market, and links it to more than 77,000 compromised accounts in nine months. Like any market leader, it invests in product innovation, customer support and an affiliate network.
In this episode, host Gary Ruddell and former INTERPOL Cybercrime Director Craig Jones explore how a criminal service builds, markets and defends a near-monopoly, and what it...
Defender: Leaving the Cyber Underworld Behind
Send us Fan Mail
The public often sees cybercrime through the lens of attacks, arrests and headlines. Far less visible are the online communities that sit behind them.
For many people, cybercrime isn’t just about the money. These communities offer status, identity and belonging, making it difficult for people to walk away once they’re inside.
In this episode, host Gary Ruddell and former INTERPOL Director of Cybercrime Craig Jones sit down with Marcus Hutchins. Best known for helping stop WannaCry, Marcus shares a side of his story that is rarely told: a firs...
The Wire: ShinyHunters - Hackers Hunting Hackers
Send us Fan Mail
ShinyHunters has left an alleged trail stretching from university campuses, and major healthcare providers, to government agencies. It even turned on its peers, extorting and publicly humiliating Cl0P ransomware group in a turf war that offered a rare glimpse of the power struggles that underpin the criminal underworld.
In this debut episode of Masked Actors: The Wire, where we take the cyber stories breaking right now and look past the headlines to the threat actors behind them, host Gary Ruddell is joined by Group-IB's Global Threat Research Lead, Anastasia Tikhonova t...
MuddyWater: Expanding an Espionage Operation
Send us Fan Mail
Successful espionage usually relies on patience. Nation-state actors quietly infiltrate targets, maintain access for years, and gather intelligence without attracting attention.
But one threat actor has spent nearly a decade rewriting that playbook.
MuddyWater has built its reputation on aggressive and continuous retooling. With ties to Iran, the group’s ambitions have only grown bolder in the past year, setting its sight on rapid expansion and relentless technical evolution.
Hosts Gary Ruddell and former INTERPOL Cybercrime Director Craig Jones sit down with cybersecurity journalist Ravie Lakshmanan, who has s...
Defenders: Two Front Lines - Fraud From the Case File and the Comments Section
Send us Fan Mail
Most people experience fraud as a single event. A suspicious text message, a fake investment opportunity, or a phone call from someone pretending to be their bank.
The reality is that modern fraud is an organised global economy, powered by criminal networks that continuously adapt their tactics while relying on the same psychological manipulation to deceive victims at scale.
Understanding how that economy evolves requires intelligence from two very different front lines: the investigators working to dismantle criminal networks, and the people encountering new scams every day.
I...
GoldFactory: Rethinking Digital Identity in the Age of Biometric Theft
Send us Fan Mail
For years, stronger authentication was seen as the answer to online fraud. As passwords became easier to steal, organisations turned to stronger forms of verification, from facial recognition and voice authentication to digital identity checks.
But cybercriminals are now weaponising those too.
This episode revisits GoldFactory, the threat actor behind some of the first large-scale campaigns designed to harvest biometric data for financial fraud. As cyber criminals increasingly target the systems used to verify identity, the group raises a much bigger question: how do we establish trust in a wo...
TX-NFC: Ghost Tap — can your bank catch fraud from a card that never left your pocket?
Send us Fan Mail
Contactless payments have become such a routine part of everyday life that we rarely think twice about how they are secured. For decades, every contactless transaction has been built on the assumption that your card needs to be physically present to make the purchase.
Now, there is one Chinese-language Fraud-as-a-Service operation that has found a way to break that assumption. First uncovered by Group-IB researchers, TX-NFC relays stolen card data to a fraudster’s device and executes a transaction at a physical point-of-sale terminal, all with the victim's card in an ent...
Defenders: The life of a threat researcher
Send us Fan Mail
Threat researchers work deep in the digital underground, mapping adversaries, exposing tactics, and turning fragments of intelligence into protection that actively stops attacks. Despite the impact of their work, the reality of what they do remains largely hidden from view.
In this episode of Masked Actors, Group-IB’s Gary Ruddell is joined by Anastasia Tikhonova, Global Threat Research Lead at Group-IB and author of the High-Tech Crime Trends report.
With over a decade spent tracking advanced persistent threat activity linked to nation-state actors, Anastasia pulls back the curtain on wha...
Scattered Spider: Could one phone call bring down your whole organization?
Send us Fan Mail
Can you recognise every employee in your organisation? Most companies cannot — and attackers know it.
A routine IT request comes in from a senior leader locked out of their account. Everything checks out, so access is restored. Except it wasn't them. In that moment, you've handed the keys to Scattered Spider — a group that has spent three years proving that human trust is a more reliable attack surface than any software vulnerability.
Group-IB's High-Tech Crime Trends Report 2026 identifies supply chain attacks as the defining force reshaping today's threat landscape, and...
Defenders: What does it take to orchestrate international takedowns across borders?
Send us Fan Mail
Cybercrime operates at a scale most people never see. A single incident can cost hundreds of millions of pounds, disrupt businesses overnight, or devastate individuals and families. What often follows is a simple question: how do you stop something that moves this fast, across so many borders?
The reality is far from straightforward. Building a case against cybercriminals means tracing activity across jurisdictions, piecing together fragments of digital evidence, and turning intelligence into coordinated action on a global scale. It is detailed, complex work with real-world consequences.
In this...
Team TNT: Could you be unknowingly mining for crypto?
Send us Fan Mail
Cryptocurrency promised huge potential for investors. But it’s cybercriminals who are reaping the benefits. From multimillion-dollar ransomware payouts to borderless money laundering, cryptocurrency has quietly become the fuel powering a global cybercrime economy.
As regulation evolves across multiple jurisdictions, gaps, inconsistencies, and the borderless nature of crypto continue to give criminal threat actors a simple workaround: move somewhere the rules don’t reach. This has created opportunities for cybercrime that groups such as TeamTNT have been quick to exploit.
In this episode of Masked Actors, Group-IB’s Gary Ruddel...
Boolka: The evolution of a cybercriminal enterprise
Send us Fan Mail
If evolution has taught humanity anything, it’s that adaptation is key to survival. As prey develop camouflage techniques, predators get faster, sturdier, and better at detection. Now this game of cat and mouse is taking over the digital world.
All cybergangs are on a cycle of relentless adaptation – but a group that stands out from all the rest is Boolka, innovating near-constantly since it first landed on the cybercriminal scene in 2022. Its primary goal is to steal user data across high traffic websites – from usernames, passwords and even credit card informa...
Brain Cipher: What happens when national infrastructure comes under strike?
Send us Fan Mail
Indonesia, June 2024 - 210 critical government agencies were crippled in one fell swoop. Immigration services were in disarray; customs officers locked out of critical systems and travellers left stranded in airport and ferry terminals facing delays that would continue for a full week.
The culprit? Brain Cipher, a ransomware group barely a week old, which demanded a huge sum of $8M from Indonesia’s National Data Centre, bringing local government services to their knees. The chaos that followed lingers as a potent reminder of the widespread disruption across an entire nation that ca...
Ajina: Can you really trust that app?
Send us Fan Mail
Cyber criminals are masters at exploiting human vulnerability and trust. In Uzbek folklore, there's a creature known for causing chaos, preying on humans, lurking in the dark and changing its face to trick its victims before it pounces.
In December 2023, it lent its name to a sophisticated Android malware campaign using the same tactics that emerged in the digital underworld. The banking malware masqueraded as legitimate applications, leaving users confused – like its folklorish namesake – and surfaced from the dark to steal everything they had. Its codename: Ajina.
Join Group-IB’s Gary R...
MuddyWater & OilRig: The cyber espionage playbook
Send us Fan Mail
As digital infrastructure becomes the backbone of global economies, cyber espionage has quietly evolved into one of the most powerful tools in modern statecraft.
Behind the scenes, nation-backed threat groups like MuddyWater and OilRig operate sophisticated campaigns that blend malware, phishing, and social engineering to infiltrate governments, defence contractors, and critical industries. But these Advanced Persistent Threat groups aren’t motivated by fame or by fortune. They’re after insights on matters of national security, looking for long-term access to strategic intelligence, and preparing tactical disruption of their adversaries.
In thi...
Joystick to Jailbreak: Exploring the Youth Cybercrime Pandemic
Send us Fan Mail
Forget everything you think you know about hackers. Today’s cybercriminals aren’t lurking in shadowy basements - they’re teenagers mastering cheat codes on Roblox, swapping tips on Discord, and using AI to launch attacks from their bedrooms.
Join Group-IB’s Gary Ruddell and Nick Palmer as they sit down with Fergus Hay, CEO and co-founder of The Hacking Games, to explore how cybercrime is becoming more accessible than ever. They dive into the rise of Ransomware-as-a-Service (RaaS), the impact of generative AI, and why the next wave of ethical hackers...
RansomHub: From RaaS Kingpin to Cartel Mystery
Send us Fan Mail
When RansomHub, one of the most prolific ransomware groups, vanished overnight back in April, it sent shockwaves through the cybercriminal underworld. With over 600 global attacks and millions extorted, their sudden disappearance left affiliates scrambling and researchers asking: what happened?
Join Group-IB’s Gary Ruddell and Nick Palmer as they speak with Pietro Albuquerque, a threat intelligence analyst at Group-IB and a leading expert on RansomHub, to unpack the rise and fall of this ransomware cartel. They explore how RansomHub’s affiliate-friendly model disrupted the RaaS market, why its tactics proved so effe...
DragonForce: The Cyber Cartel Helping Hackers Hit the High Street
Send us Fan Mail
Empty shelves, lost customers, and hundreds of millions of pounds in lost profit are just some of the outcomes that retailers have faced in the wake of recent ransomware attacks. From the Co-operative to M&S, the recent cyber attacks on UK retail giants have dominated headlines and wreaked havoc that’s been felt by customers, staff, and government officials alike.
The culprits behind it? A highly organised group of ransomware specialists, codename: DragonForce.
Join Group-IB’s Gary Ruddell and Nick Palmer as they speak with Jason Rebholz, an expert...
Lazarus: Is your best IT worker really a North Korean hacker?
Send us Fan Mail
In December 2014, Sony Pictures announced they were cancelling the release of Seth Rogan’s newest venture The Interview due to a large-scale cyberattack. And in February of this year, global cryptocurrency exchange Bybit suffered a massive attack resulting in the theft of $1.5 billion.
These masked actors are still active. But now, they’ve turned their attention to companies like yours...
Join Group-IB’s Gary Ruddell and Nick Palmer as they speak with Geoff White, one of the worlds leading journalists covering organized crime and tech and the author of The Laz...
GoldFactory: The cybercriminals who want to steal your face
Send us Fan Mail
If a cybercriminal steals your password, you can change it. But what happens if they steal your face?
Former soldier turned hacker, Gary Ruddell and financial crime veteran, Nick Palmer, explore the actors behind GoldFactory - a cybercriminal group stealing users' facial recognition data to clean out victims bank accounts.
Joined by Craig Jones, who spent five years at Interpol as the director of cybercrime, Group-IB's Gary and Nick explore how masked actors are exploiting AI and Deepfakes for financial gain.
In...
Cybercriminals Exposed: Welcome to Masked Actors
Send us Fan Mail
Welcome to Masked Actors — a true crime-inspired podcast from Group-IB that brings you face to face with the people orchestrating some of the most sophisticated cyberattacks on the planet.
Join hosts Gary Ruddell — former soldier turned hacker and cyber threat expert — and Nick Palmer, a financial crime veteran, for the gripping new series which uncovers the tactics, motivations and real-world impact of the top 10 most prolific cybercriminal organizations of 2025.
By understanding who these actors are and how they operate, you can better anticipate threats...
