Hackers infected the wrong girlfriend....

About this video

The video profiles Bitdefender’s Draco team in Romania — malware researchers and forensics experts who by day work for Bitdefender and volunteer after hours with law enforcement to fight cybercrime, keeping members’ identities secret for safety. The central case is ransomware-as-a-service, explained as a franchise: a core group builds the malware and affiliates distribute infections, splitting proceeds the creator describes as 30% to developers and 70% to affiliates. When the GandCrab ransomware — said to have controlled 50% of the market at its peak, with a default $600 ransom tiered by file value — infected the girlfriend of a Draco penetration tester, the team spent two and a half years releasing five decryptors. Each time GandCrab updated the malware, Draco released a new free tool, destroying affiliate trust until the group shut down. The group then rebranded as REvil (also called Sodinokibi), linked in the video to attacks on JBS, Colonial Pipeline, Kaseya and an Apple supplier; Draco’s decryptor for it is credited with stopping $1 billion from being paid, and a discovered backdoor showed REvil cheating affiliates. The video then turns to AI-enabled crime — better phishing, voice cloning from, the creator says, eight seconds of voice, stream-jacking and celebrity deepfake ads — and Bitdefender’s counter-AI: deepfake detection that also analyzes intent (satirical vs. malicious), an AI scam-call honeypot that wastes scammers’ time while collecting intel, and work on correlating multi-platform scams that move across WhatsApp, browser and phone. Victim stories — a PhD student whose thesis was recovered the night before his defense, and a Syrian couple whose only photos of their two children killed in war were decrypted from a $350 ransom demand — frame why the team fights even though, as Bitdefender staff admit, they are only putting a dent in cybercrime, not stopping it.

Key takeaways

• Ransomware-as-a-service splits work and money between core developers and affiliates, so breaking affiliate trust can dismantle a group
• Draco’s repeated free GandCrab decryptors over 2.5 years drove affiliates away until the group closed
• The REvil decryptor is credited in the video with stopping $1 billion in ransom payments
• AI is lowering the skill barrier for criminals and improving phishing, deepfakes and voice cloning
• Defenders are responding with deepfake/intent detection, AI scam honeypots, and multi-platform attack correlation

Episode details: published November 28, 2025 · 26:57 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: You SUCK at Prompting AI (Here’s the secret) · Next: I’ll never use n8n the same…… →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube