Tammy tracks ransomware gangs for a living. At Flare, she digs through leaked chat logs, dark web forums, and threat actor conversations to figure out how these operations actually run. Not the headlines version. The real version.
Her team mapped out Black Basta's entire corporate structure from their leaked Matrix chats before law enforcement publicly named the leadership. She's a core contributor to RansomLook and Ransom-ISAC, and she speaks at conferences around the world about the people behind the attacks. Not just the malware. The psychology, the paranoia, the economics, and why the whole ransomware business model is starting to crack.
She kicked off DC416's relaunch in January 2026 with Syndicate: Inside the Life of a Ransomware Operator during a record breaking snowstorm. The room was packed. If you were there you know why.
When she's not infiltrating criminal forums she's looking at the stars, playing tennis, running through the city with techno in her headphones, or being a cat mom.
Talks at DC416
Syndicate: Inside the Life of a Ransomware Operator
The underground economy of cybercrime. The pipeline from script kiddies to affiliates to full corporate syndicates. Leaked Black Basta internal chats showing offices in Moscow, HR, payroll, managers. A Fiverr worker making $20/week who had no idea he was doing recon for a ransomware gang. The Change Healthcare $22M ransom and the affiliate who never got paid. Why 1 in 20 ransomware attacks pay decent now and the economics are falling apart.
Affiliations
- Flare.io - Senior Threat Intelligence Researcher
- RansomLook - Core Contributor
- Ransom-ISAC - Contributor
- International Speaker - Cybersecurity Conferences