[rmahan]

Seems like he probably would have been caught either way, but would have costed and taken longer if he didn’t drop his VPN. Being one person in a closed room of people knowing about the ransom, and using PayPal over crypto to pay for a VPN seems like it would leave a trail. Eventually would’ve narrowed it down, hopefully.

Edit: oh, and using his own keys that were tied to him as an employee while he was being the attacker.