Hunting Medusa: How One Flaw Took Down a Ransomware Gang ft Cristian Sindile

A broken leg. One overlooked WordPress setting. Three ransomware groups knocked offline. In this episode of the NEVERHACK Cybercast, host Britta Sillaots and co-host Louis Zezeran sit down with NEVERHACK SOC analyst Cristian Sindile to unpack the story behind his BSides London 2025 talk on disrupting the Medusa ransomware gang. Cristian reveals how he traced a gang's hidden Tor leak site back to a real IP address in Russia using an overlooked WordPress feature — exposing live ransom negotiations, payment sums, and Bitcoin addresses to law enforcement. From there, the conversation dives into the real craft of offensive cyber threat intelligence: OPSEC fundamentals, the psychology of infiltrating dark web forums, earning trust to harvest threat actors' own tools, and the fine line between responsible disclosure and vigilantism. It's a candid, fast-moving look at the human side of cybercrime — and how curiosity plus discipline can disrupt an entire criminal operation. 🎧 Listen now, subscribe for more, and share it with your team. Topic suggestions? Email [email protected].