I'm skeptical. Maybe the FBI did use some illegal tool or more likely, a legal tool that they control the backoffice for, but the story I read outlined some pre

I'm skeptical. Maybe the FBI did use some illegal tool or more likely, a legal tool that they control the backoffice for, but the story I read outlined some pretty common blunders. This makes all the more sense if he was a mono-technical web app guy for most of his career. If he did pay with paypal, that was his first mistake. Theoretically, you pay for your VPN with a gift card you bought with cash, maybe even one you got in another state and use anonymous email receiver to get your keys. Rotate accounts as project phases are completed. Theoretically, use a purpose-built machine to keep fingerprints out of the mix, and as others have said, a killswitch using iptables/UFW to only allow traffic through the VPN gateway. Probably wouldn't have hurt to rotated the VPN egress points as well. Theoretically, he should have been connecting this VPN over a public hotspot not his home network. I get that this wouldn't be conducive to downloading gigs and gigs of data, but if you're the one setting it up and monitoring/junking any logging on the other side, you could also afford to do this with an SBC (or several, again bought with cash) concealed at some location(s) that just pulls the information by slow drip over public connection via VPN. SBCs get tossed into Willamette as they're rotated. The FBI cyber guys are good and creative but with a reactive situation like this I think old-fashioned gumshoeing, interviews and subpoenas would get them a long, long way. Once they had an inkling that it was an inside job, man, just relentlessly picking away at that with some face time would be really productive. Guaranteed that guy wasn't prepared for the bright light of honest incidental questioning, over and over, much less focused questioning. Not to mention, they are free to lie to your face in those interviews about what they do/don't know. Once they had a list of four people, start shoving out the subpoenas and see what clicks. Part of their toolbox is also having an idea of what real attacks look like, knowing what those actors care about leaving behind or not concealing, and in the absence of those earmarks, they know they're looking at something "unusual". Now if I start telling you that I did find evidence of an attack of type Y where there absolutely is none, and you're all too eager to help me prove that theory, that's probably a bad sign. Did he have a plan of his own in place to frame some other ransom toolkit or plant seeds of a breach? I mean, what would you think if you walked into a company that got hit with a massive ransom demand, evidence of data theft, but no typical signs of a data breach from the usual suspects? State actor? Now this is serious. Was it their Exchange or RDP server in the closet? Oh, you're cloud-only? What platforms are we talking about? A state actor has zero-days into a major cloud platform?? MS? AWS? Now this is really serious. Or... maybe none of that is the case. Log files are all missing? Who made that decision? I mean, on and on it goes, but it seems pretty easy to see it unravelling once you start pulling on a thread. If one was really interested, they could probably find some good information in PACER about the information that supported the indictment. Chances are he's already confessed and is attempting to plead out. They'll surely throw the book at him. Insider ransom jobs on US hardware companies are not a tolerable phenomenon.