[nubg]

Seems like there is an achilles heel for this business model: A "good guy" could start hacking companies, demand ransom while pretending to be one of the gangs, and then deliberately continuing the attack after the ransom is paid. Precisely to destroy this business model. The gangs would be fuming but there would be nothing they could do? Apart from trying to track down the "good guy" or introducing some sort of (cryptography based or whatever) proof-system that a hack was made by them?

[ronsor]

"Chaotic good" guy, yes, but it's easy to know what groups hacked a company because the groups have their own blogs with known addresses and published victim lists.

If someone claiming to be LockBit hacked you, and you're not on the LockBit blog within a week, it's probably not really LockBit.

[chistev]

This is an interesting thought. I'm waiting to see responses to it.