Online "reputation management" is easy work, it's a very grey area, and it would take a lot of investigation to reveal that someone has actually been targeted and attacked.
But take medication sellers, the covers are great, but it only takes one customer to brag about it and then it's a matter of time until you're done. Anything said online will come under the review of authorities sooner or later.
If we are do delve deeper, real world hits are even riskier. And they don't pay enough! Sure, I guess the people at the top of these organizations make serious dough, but the ones doing the work are paid peanuts.
I guess it takes a special kind of person to do that, someone with a death wish, nothing to lose, and probably a massive hate boner for something.
I've always been fascinated by the criminal "underworld", even though I would never participate in anything, too much risk for too little reward.
In the case of Russia; they might be doing informant work for SVR or GRU. In which case, they can pretty much operate with impunity, as long as they don't attack the wrong Oligarch's operations.
Meta: It's nice to see an opsec company get smart and publish some of the better thinkers/communicators (like thegrugq) over writing product-tailored in-house content. Maybe security is an easier field to do this for, as being scared (justifiably or otherwise) is generally good for business.
EDIT: expanded comment
It is very unlikely that FIN7 are aware of their successful exploitation of the golden triangle. They almost certainly just pursued what worked best for them, creating a lean mean cybercriming machine along the way. (And isn’t that the real treasure?)
Financially motivated crimes are essentially businesses, and so sometimes it can be useful to use business frameworks to understand the criminal enterprise. Fortunately FIN7 happen to be a particularly well documented, making such analysis possible.
I don’t really know what to say re: your meta comment. I wrote some posts for them under contract. I had complete editorial control. I have no idea if it is easier than in other fields. None of the other posts (not posted yet) are about “scary” topics, so I’m not sure if the observation is correct.
Maybe not a nitpick, I don't mean to dismiss Okta's endeavors; but it's certainly something that's caused a flutter of the eyebrow and an almost automatic reaching of the hand to ponderously scratch the beard.
