Masked Actors
True crime meets cybercrime. Discover the people behind the keyboard.
From Ransomware-as-a-Service (RaaS) gangs to global financial crime syndicates, the rise of sophisticated cyber threats is reshaping the world. These aren’t lone hackers — they’re organized groups running multi-million dollar operations in the shadows.
In the Masked Actors podcast, cyber threat expert and former soldier turned hacker Gary Ruddell joins forces with Nick Palmer, a seasoned financial crime fighter, to investigate the top 10 most dangerous cybercriminal groups of 2025 — drawn from Group-IB’s High-Tech Crime Trends Report.
Each episode explores the tactics, motivations, and impact of major cybercrime groups, uncovering their role in the latest cybercrime, RaaS, and financial crime trends. You’ll learn how these actors exploit vulnerabilities, fuel geopolitical tension, and affect businesses and consumers alike.
Tune in to Masked Actors — and stay one step ahead of cybercrime.
Masked Actors
DragonForce: The Cyber Cartel Helping Hackers Hit the High Street
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
Empty shelves, lost customers, and hundreds of millions of pounds in lost profit are just some of the outcomes that retailers have faced in the wake of recent ransomware attacks. From the Co-operative to M&S, the recent cyber attacks on UK retail giants have dominated headlines and wreaked havoc that’s been felt by customers, staff, and government officials alike.
The culprits behind it? A highly organised group of ransomware specialists, codename: DragonForce.
Join Group-IB’s Gary Ruddell and Nick Palmer as they speak with Jason Rebholz, an expert on the ransomware ecosystem, with over a decade of experience performing forensic investigations into complex cyberattacks.
In this episode, they unpack how DragonForce evolved into a ransomware cartel, franchising their malware to affiliates like Scattered Spider, whose sophisticated social engineering tactics have significantly disrupted UK retail. They explore the wide-ranging impact on both businesses and consumers, offering insights into how each can better protect themselves. Finally, they examine the role of policy and regulation in preventing future attacks and strengthening cyber resilience.
By understanding who these actors are and how they operate, you can better anticipate threats and protect yourself in an increasingly hostile digital world.
Subscribe now to meet these Masked Actors — and stay one step ahead in the fight against cybercrime.
Episode links:
Group-IB's Top 10 Masked Actors
Inside the Dragon: DragonForce Ransomware Group
By understanding who these actors are and how they operate, you can better anticipate threats and protect yourself in an increasingly hostile digital world.
Subscribe to learn more about Group-IB's top 10 Masked Actors - and stay one step ahead in the fight against cybercrime.
FOLLOW GROUP-IB
- Group-IB Threat Intelligence on X: https://www.x.com/GroupIB_TI
- Group-IB on X: https://www.x.com/GroupIB
- Group-IB on LinkedIn: https://www.linkedin.com/company/group-ib
- Group-IB on Facebook: https://www.facebook.com/groupibHQ/
- Group-IB on Instagram: ...
It's easy to feel a false sense of security when it comes to cyber attacks. To the average person, cyber attacks can seem a bit abstract and well cyber. But the fallout from these attacks is very much real. Empty shelves, lost customers, hundreds of millions of pounds in lost profit. These are just some of the outcomes that retailers have faced recently. From the cooperative to Marks and Spencer's, you may have heard of these attacks. They've dominated the headlines. And this effect has really been felt by customer staff and governments alike. Now, in both of these high-profile retail cases, one culprit's fingerprints are everywhere. A group of highly organized ransomware specialists called Dragon Force.
SPEAKER_01Before we dig into Dragon Force, I'd like to introduce you to a guest speaker. He's an expert in the ransomware ecosystem, Jason Rebhols. So Jason is the co-founder and CEO of Evoke Security. He leads the charge providing fractional CISO and AI security services. But importantly, for the topic of Dragon Force, he spent more than a decade performing forensic investigations into complex cyber attacks, including ransomware. He now puts that expertise to work helping organizations securely build and deploy AI. Jason, thanks a lot for being here with us.
SPEAKER_02Thanks for having me.
SPEAKER_01Could you give us a little bit of background on your history with malicious actors like Dragon Force?
SPEAKER_02Yeah, so I have uh been fortunate or unfortunate, depending on how you look at this, as riding the ransomware wave. So when I was doing investigations, I can remember starting when the first enterprise ransomware events happened. And so this goes back to a group called Samsam, where they were the first ones who went from a single system encryption to an enterprise encryption. So they would target servers in the environment. And that's when we started seeing larger and larger ransom payments. Now that eventually evolved into ransomware as a service, where you have groups like Lockbit, where they are just providing the ransomware executables, the infrastructure behind this. And now we're to the point where we have Dragon Force, where it's this first self-proclaimed cartel. And what's really interesting here and what sets them apart from these other ransomware groups is it's the first real instance where you're seeing a targeting of other ransomware groups. So what piqued my interest, I first learned about this when uh Dragon Force went after BlackLock and they took their systems down, they defaced the sites. And so then they started doing this with others, but really they came to fame when they went after Ransom Hub. And Ransom Hub at that time, this was back in like the February, March timeframe, they were one of the top ransomware as a service groups out there in terms of the number of victims that were getting posted to their leak site. And then overnight, Dragon Force attacked their infrastructure, took them offline. And now we see a whole new kind of wave of ransomware that's starting to come out here where we're just we're looking at a whole different environment now. So it's really interesting in some respect, but also terrifying to kind of see where is ransomware going to go from here.
SPEAKER_00Yeah, that cartel model is crazy. Uh, you know, it really is cartel-like behavior, uh, gangs fighting amongst themselves. I'm s I'm so used to just dealing with ransomware as a service. You know, insert your company name, you got hit with ransomware at the end. Uh, you know, some data gets stolen and it's on a data leak side. But this model where they're taking each other on, that's really interesting. Uh, I guess in some ways, they're doing the world a justice. They're doing us a favor because there's less players now, but I'm sure it's just not that clean and simple.
SPEAKER_02Yeah, it's it's really weird because when you look at some of the language that they're using, in some sense, they're trying to create this new ecosystem where any ransomware group can come use their infrastructure and keep their own name, right? So traditionally you would see ransomware as a service, they would be hosting their own infrastructure. It's it's their own little brand, right? Just like Lockbit was, just like Conti was. Like it's a specific brand, and you have these affiliates who are the actual hackers themselves that would go and just sign up to be an affiliate there. And now Dragon Force is coming out and saying, hey, we just want you to use our infrastructure and just come along. You can keep your name, just use our infrastructure. Now, there might be some things that are that are some positives that are available for them uh as a result of this. You know, they can get some good intel, they can just focus on the executables and the infrastructure, but it's really kind of a weird play. And when you look at some of the uh some of the language that they're using on their blog post, uh specifically around some of these recent attacks, it's very much so in kind of like just mean-spirited attacker where like they're calling out victims. So it's just really bizarre. I know they have you know their hacktivist roots, but it's this weird kind of feeling right now that just doesn't fit into what we've seen with ransomware as a service groups in the past.
SPEAKER_01With ransomware as a service operators, could you clarify a little bit for our audience what is the difference between Dragon Force and Scattered Spider?
SPEAKER_02Yeah, you know, this is interesting because when you look at a lot of the recent attacks against retailers, you know, you hear one news report and it's saying it's scattered spider. You hear another news report and it's saying it's Dragon Force. And so you're kind of left wondering, like, well, who is it? Right. And so the answer is, well, it's kind of both, right? And so if we step back and look at what the ransomware ecosystem looks like, there's really two key players here, right? You have the ransomware as a service group. So this is what you typically hear as the ransomware variant, right? So Dragon Force is this ransomware as a service. You know, they they might try to label themselves as something else, but for all intents and purposes, they are a ransomware as a service group. Now, what they do is they focus on the infrastructure needed to execute on a ransomware attack. So they're gonna give you a platform where it will host your leak site. So after you steal data uh and you upload that to this leak site, people can see that. They're gonna provide you the builders for the ransomware executables. So, you know, uh for Dragon Force, they're using leaked builders that they've built upon from Lockbit and Conti. And so as uh as anyone can go and sign up and then be in a position where they can build their ransomware executable for various platforms, whether it's Windows, Linux, or they have virtualized environments as well that you can go after. Now, the affiliates, these are the people doing the grunt work, right? So when you think of somebody that's hacking into the company, either from social engineering or some sort of external vulnerability, those are the affiliates that are doing that. And so they break into the environment or they might even purchase access into the environment that somebody else has hacked into, and then they're gonna go from that initial access to the point where they can deploy ransomware in the environment. That's the affiliate. So when we think of Scattered Spider, that is the affiliate. They're the ones that are doing the attack. Scattered Spider is then going to Dragon Force, downloading that executable, encrypting systems or stealing data in the environment, and then hosting the stolen data on Dragon Force's league site. So it's this really symbiotic relationship between the two. And the reason why this has evolved to this point is because you can specialize in certain things. You no longer have to be in a position where you have to be able to write a ransomware encryptor, where you have to host your own league site, where you have to hack into companies. Uh, the ecosystem has really matured to the point where you have specialization and people can push their own agendas forward and really focus on the things that they're good at and continue to just evolve their craft in a very narrow focus versus having to be a generalist.
SPEAKER_01Can you tell us a little bit more about the financial model behind Dragon Force? Is it similar to Lockbit, you know, the usual 80-20 model, or is it something different?
SPEAKER_02Yeah, it's fairly similar there, uh, where they do an 80-20 split between the affiliate grabbing the 80% and the ransomware as a service group grabbing 20%. Uh what's interesting though is with Dragon Force, they're they're starting to make a call where not anyone can sign up to be part of their affiliate program anymore. Uh and the reason for this is that these ransomware groups are getting tired of journalists and law enforcement signing up to be an affiliate and then finding ways to, you know, siphon data from them or you know, eventually break into their infrastructure. And so what Dragon Force is calling for now is they want to have a guarantee, uh, so somebody that can vouch for you that is a known entity in the criminal ecosystem or a deposit in Bitcoin, or it's actually Monero in this instance. And so it's a way that they can try to de-risk it, that not anyone is going to be able to just sign up and start collecting information. Uh, but you know, that's one of the ways that they're starting to steer the uh the model in a different direction.
SPEAKER_00And I guess I see a gap in the market now for someone who provides vetting services. So someone can apply, but it comes to Gary and Jason's vetting broker, and then we uh onboard them into the actual uh ecosystem. Yeah, that's that's kind of the way this whole thing's going, right? You're probably gonna get something like that at some point. I just I can't imagine, you know, filling out a Google form or sending a message on a dark web forum to join, you know, one of these programs, and then you get the Google Meet invite for your interview or whatever it is. That must be crazy.
SPEAKER_02Yeah, it's it's this balance between anonymity for cyber criminals, but also that need to make sure that you're not dealing with law enforcement. And so uh, you know, you look at law enforcement and they are stepping up the disruption campaigns against these ransomware as a service groups. Uh, and quite honestly, it's pretty amazing because you have it to the point where law enforcement is trolling these groups. You know, there was uh you have uh LockBit where they took over the leak site and they turned the leak site against them, where they started releasing information on the affiliates, on uh who they believe is the administrator behind Lockbit. Uh there was a recent takedown of another uh group where the uh law enforced law enforcement used Gen AI to create a music video uh of the group. It's just it's absolutely insane right now. But to your point before, you know, do you go after the ransomware as a service group or do you go after the affiliates? And the answer is both, right? But when you look at the takedown of these ransomware as a service groups, you know, you can you can have a big impact by taking one of the main players off the stage, but for the affiliates, they'll just go to somebody else, right? So look at Scattered Spider. Before they were using Alf V as one of their uh their ransomware as a service groups. Alf V got taken down by law enforcement, and now you start seeing Scattered Spider using Dragon Force. And so it has a little bit of resilience built in, just like it would in a free market, where these affiliates can kind of go where they need to go. Uh now at the same time, if you look at law enforcement activity, you know, they arrested four individuals related to the attacks on MS and co-op, uh, and I think Herod's as well, where it's four individuals between the ages of 17 and 20 that were based in the UK. And so you have to have both there to really make an impact. And it's it's kind of an un like an impossible job to try to clean house of all these groups, right? But in my mind, it's really about how do you raise the the barrier to entry or the friction that these uh these attackers operate in, because you you can't you can't live in a world where these cyber criminals can operate without impunity. So you have to put a little bit of fear in that. And that's where I think law enforcement is doing a really good job.
SPEAKER_00Yeah, they've they've got a tough job as well. Um but I guess they're you know they're getting better with all the intel share and I you know that goes on at an Interpol level. Uh that definitely helps bridge some of these gaps and speed up, you know, cross multi-jurisdiction uh investigations. Because before when it all started, it was a right headache. But I think now they've done it that much, they're getting a lot better at it. Um you talked about you know the 17 to 20 year olds doing this stuff. You know, that's for the 20-year-old, that's 20 to 25 in prison, right? When you get caught doing this sort of thing. Uh do you think that's proportionate?
SPEAKER_02That's I think there's a a pretty big philosophical question behind that. You know, I I think unfortunately for these kids right now, they're getting sucked in at an early age when they may not know better, right? And so you look at a lot of these kids that are in Scattered Spider and, you know, various other groups like the comm where you know they're getting sucked into this when they're 14, 15 years old. And it's just, you know, some of it is from the online gaming community where they kind of find a path into this. Uh, some are just curious and they want to learn more about various things because you know, hacking is an interesting topic. It's like a big puzzle. Uh, I know when I got into cybersecurity, hacking was one of the ways that that really I got into it, where I was really interested in it. Uh, thankfully I took a different path. But for these kids, when you have these online communities, you know, that that's that's your social structure there. That's you know, those are your peers. And so I think it's really kind of an unfortunate thing right now where they get sucked into it. They don't have a better option that they can see, even though plenty of options exist. And so right now, it it might be that they're just being made an example out of, right? Where, you know what, it doesn't matter how old you are, you made a a series of poor decisions. Because a lot of these, when it's getting to the point where you're taking down these types of companies, it's not your first time doing it, right? There's a series of steps that have to happen. And so, yeah, I think unfortunately for these kids right now, you know, they're getting stuck in the middle of this where they're going to be made an example out of this. And so I can't say whether it's proportionate or not, but you know, this is where, you know, you really got to step back and say, is this, is this actually a crime that is not victimless, right? Or, you know, a lot of times you think it's a faceless crime or a victimless crime. A lot of times these actors look at these companies and say, well, they have millions and millions of dollars, so what does it matter? Uh, but it's just kind of a uh an illusion that's not really steeped in reality here, right? Like these attacks have a big impact on the companies, on individuals in the company and outside of the company. Uh and so yeah, I think unfortunately, you know what, they're gonna get made an example out of. Uh, and they really have to recognize these groups of kids have to recognize that, yeah, there are consequences to these actions.
SPEAKER_01So looking at one of the most prolific ransomware attacks to date, well, at least in recent memory, Marks and Spencer, the chairman of Marks and Spencer, Archie Norman, even had to appear in front of members of parliament the first week of July to discuss the attack. He revealed that the breach would likely cost the business about 300 million pounds and a loss of operating profit. Similar figure to Mersk, actually. They had to also suspend online orders for clothing lines for a period of 46 days, and click to collect services were suspended for even longer. Jason, what are your thoughts on this?
SPEAKER_02Yeah, you know, I this is something where a lot of times victims will say that it's a sophisticated cyber attack. Uh, and in most cases it's not, right? It's kind of your standard vulnerabilities that you know kind of compound over time. In this case, we know that it was scattered spider. And we do know that scattered spider has some better social engineering techniques than others, right? So, you know, it's one, they're they're native English speakers, they target help desks where they'll try to get password resets, they'll be able to reset MFA. And so, yeah, you can have the best security in the world on that perimeter, but if your help desk makes a mistake where they don't verify the individual, it's kind of game over there, right? So, um, you know, when they when that's uh when they're saying that the systems weren't vulnerable, they might be right because it was social engineering, but you know, you also have to secure the human during these these situations as well. You know, I the the one thing that really stuck out to me though was that he said that the the practice drills and the simulations was nothing like happened. And that is such a common feeling that I've seen come across every organization that I've worked with in my career doing incident response. And you know, the reason for that is one, you can prepare, you know, you can go through the exercises to kind of simulate what these attacks look like. But the first time that somebody breaks into your environment, it's like somebody breaking into your house, right? You feel violated, right? It's somebody that came in, they did something potentially destructive, and now you're having to pick up the pieces. And so I would go into these conversations with uh these victims and say, listen, this is this is probably going to be one of the worst days of your career, right? It's a it's a really tough feeling to know that your system's been taken down. Uh, and when you're losing upwards of $300 million, right? That's that's a very bad day. And so a lot of times, like I've heard people experience this as an out-of-body kind of experience. And it's a lot to process and it's a lot of stress when you're trying to get things back up and running as quickly as possible. Uh, so that, you know, in this case, it was what, 46 days of outage uh where they couldn't sell anything. And so that's that's a really difficult situation to be in.
SPEAKER_00Yeah, big time. Um, you said a few things there reminding me of my time in the military and in different places around the world. And, you know, you can practice bleeding, as we call it, you know, first like for you know, first aid training almost, but there's fake bullets and grenades and things involved. You can do it as much as you want. It does help. Um, and the more realistic you can make make it the better. Um, but not in is like the real thing. So, you know, the team that went through this at Marks and Spencer's and the co-op, uh, whilst it may be easy for us to say, and you might see this online as you know, it's terrible, they didn't patch these things, blah, blah, blah. Uh, they have been tested, all of them. They because they were all involved in some way to like get all this, you know, back up and running. So um they're in a better position the next time this happens, because they've all done it, and I, you know, I haven't done it. I've never recovered from a ransomware attack, thankfully. Um, so yeah. Well, uh, what can we expect sort of from you know Marks and Spencer's and co-op, you know, going forward? You know, obviously they've lost the revenue. Um, are there any other impacts that we aren't thinking about other than revenue?
SPEAKER_02Well, even on the revenue side, the there's still cyber insurance, right? And so this is something that the chairman had made a comment about where he said, hey, like we're we we lost three or potentially gonna lose 300 million, some of that might be offset by insurance. And so, you know, which is accurate, it's all gonna come down to how much insurance that they bought and uh the type that they bought. And so in cyber insurance, there is this concept of business interruption. So if your systems go offline due to a cyber attack, depending on the policy that you bought, you might be able to recoup some of that lost revenue. Uh and so I think that's the angle where the chairman was coming into this saying, hey, like we might be able to get something back from that. Now it's not going to be all 300 million, uh, but that can that can really help you address some of the financial losses. And that's why, you know, I always advocate for getting cyber insurance because it can help pay for the investigation, it can help pay for the recovery services. Uh, and in this type of situation, if you have the right coverage, it can help offset some of the revenue loss that you may have experienced because of these ransomware attacks. And so from the financial standpoint, you know, you don't have to operate where it's going to be a total loss. You just have to have the foresight to purchase cyber insurance ahead of time.
SPEAKER_00Yeah, it'll be an interesting conversation now, won't it? You know, if I was the CISO at MS and I said, right, team, we've just lost 300 million. I need, I don't know, I don't know how much cyber insurance is, but I need 10 million to buy cyber insurance that covers us for 150 million. You know, those figures, like how they talk through that and calibrate it, those conversations would be fascinating to sit in on. Um because, you know, just just because it happened before doesn't mean it's going to happen again. Uh and equally, now that you've patched all your systems and you're back, that also doesn't mean that you're secure. You could have you could still be insecure. Um It's a nightmare of a of a thing. And that's one of the things, you know, I like about physical security is there's a door and there's two bodyguards, they're armed to the teeth, there's cameras, and the door's locked with a you know a big time code on it. You know, that's a to me that feels stronger than some of the cyber stuff, but maybe that's because you know you and I are so close to cyber, we see people get popped all day, every day, practically. Um on the on the co-op side of things, they've partnered with the hacking games. What do you think about that? Like, do you think that helps?
SPEAKER_02I I think that there's uh a good PR story to be had here, especially with the fact that you're dealing with Scattered Spider, that was the one that attacked them, right? Uh I think they partnered with them just before it became public that the perpetrators behind that attack were between 17 years old and 20 years old. And so, you know, this is something where you know going back to that conversation before around the age of these hackers and having to try to intercept this early, I think it's an amazing thing to try to push because when these kids are getting online and they're getting sucked into these gaming communities that potentially lead to these cyber uh, you know, kind of hacking type of forms and communities as well, a lot of these kids don't know that you can have a career in cybersecurity. And so I think it's amazing to try to get in there early enough and educate them on other paths they can take that don't involve going down this route of hacking into other companies and trying to uh to steal money. Uh and so, yeah, I think it's awesome. Uh it's, you know, is it gonna help them particularly in the future? Maybe not. Is it gonna help the world? Yeah, it's got a good chance of that. And so I I think it's pretty cool that we're seeing more investment go into that. Uh, and I think for that um that particular group, it's awesome that they're really trying to tackle this uh where they can help these kids earlier in their lives.
SPEAKER_00So, what's your take on cyber impacting reputation? When does it, when doesn't it?
SPEAKER_02Uh, I think for the majority of these companies, what I've seen is that they might take a short-term impact in terms of reputation, but people have their favorite stores. Uh, and you know, at this point, cyber attacks are, you know, they feel like they're a dime a dozen at this point, right? Uh every day it seems like there's another victim that's getting posted. Uh there's another headline that comes up, you know, big headlines that come up at least, you know, every few weeks, if not, you know, every every month or so. And so I think people are just becoming used to it. And so the reputational hit, you know, it would have to be something really, really bad for that reputation uh hit to really kind of cement itself. But, you know, I've looked at uh stock market performance after these major events as well. And you know, you'll normally see a short-term dip, but they usually come back stronger than ever. And a good example of this is CrowdStrike. You know, it's not a cyber attack, but when they took down, you know, literally the internet uh because of because of their uh faulty software update, their stock tanked. And that was probably, you know, maybe arguably one of the worst PR nightmares for a security company, cybersecurity company. Like you, you're not supposed to take down all these systems, and you know, their stock is stronger than ever, right? And so uh people have their favorites, you know, they get used to things. So I think, yeah, that reputational loss, short-term hit. Uh you might lose a couple customers here or there, the ones that, you know, maybe are a little bit more paranoid or uh whatever it might be. But you know, outside of a short-term financial impact, uh, you know, for these larger companies, it's not that big of a deal. Now, smaller companies may be a different story, right? I've definitely seen reports of companies going out of business because they couldn't recover from a ransom or attack. And so it's a little bit of an uneven playing field in that regard.
SPEAKER_01So when these breaches happen and customer data gets stolen, is there anything that the general public can actually do or should do to protect themselves?
SPEAKER_02Yeah, so the first part is like what data was potentially stolen there, right? And hopefully the company is doing notifications to these uh victims that the data was included in uh so that they can take the right measures. Now, for me, one of the things that I've always seen is that a lot of times they're gonna give you free credit monitoring, right? I I have been riding the free credit monitoring wave from breaches for the last like 15 years at this point, right? Uh but that's not enough to protect me. So, you know, one thing that I always recommend to people is that you should just freeze your credit. Now, in in the in the states, there are three major credit unions that you would work with uh to freeze your credit. And it's not a a hundred percent effective, right? But if somebody is trying to steal your identity and say take out a loan in your name or whatever it might be, that could be a proactive defense against stopping them. Uh outside of that, right, it's it comes down to just the the basics of cybersecurity, right? So I I don't care who you are, right, whether you're you're technical or not, what I always recommend to everybody is use a password manager so that you have unique passwords on every single site. Don't use reuse your passwords. And two, set up multi-factor authentication for any website that that allows it, right? And there's this new technology, passkeys that's starting to gain adoption. Uh, it's easier to use. You can use it with your password manager. Uh, and that is something that is very secure against people trying to steal your uh your account information, uh your username and password, and then trying to log in as you. So password manager, MFA, credit locks, you know, that's a thing that anyone can do today to really help put themselves in a position to protect their uh their online identities moving forward.
SPEAKER_01Well, Jason, that's all the time we have for today. Thanks a lot for joining us and for your insightful comments. Yeah, thanks for having me.
SPEAKER_00Cheers. See you next time. Your data is valuable and it's under attack. Cyber espionage groups, financially motivated threat actors, ransomware attackers, and other criminal enterprises are on the rise. Working in secrecy to dismantle security perimeters, they spread like a virus through the web. Stoking geopolitical tensions, holding businesses to ransom, and flooding criminal marketplaces with sensitive information. These groups thrive in secrecy now more than ever. Knowing who your adversaries are is critical. So join us as we ask who's behind the world's most prolific cyber criminal groups. What are their tactics, their motivations, and their impact? Who are the world's masked actors? Masked Actors is an independent podcast from Group IB, a leading voice in the fight against cybercrime. The threat landscape evolves quickly, but all information was correct at the time of recording and based on Group IB's high-tech crime trends report 2025. Join in the conversation online using the hashtag masked actors. And don't forget to subscribe so you don't miss an episode. Thanks for listening. See you next time as we uncover more of the world's top masked actors.
.png)
