The Paradox of Criminal Morality
Criminals With Ethical code?
Cyber Threat Intelligence | November 2026
When you think about ransomware groups, the words ethics and morals probably aren't the first things that come to mind. After all, we're talking about criminal organizations that make money by stealing sensitive information, disrupting businesses, and extorting victims. But something I find particularly interesting about the cybercriminal ecosystem is that not all threat actors operate under the same rules. Some have surprisingly specific restrictions about who they will target, while others appear to have very few boundaries at all.
Occasionally, those differences become visible in unexpected ways. For example, what happens when a ransomware group attacks an organization that it claims should have been off-limits? In some cases, the answer is something you might not expect from a criminal organization: an apology.
Two incidents, nearly four years apart, provide an interesting look at the psychology behind ransomware operations, the motivations that influence criminal behavior, and why understanding the people behind cyberattacks is just as important as understanding the technology they use.
When Ransomware Operators Apologize
In October 2026, the University of New Mexico Health Sciences Center experienced a cyberattack that disrupted healthcare operations, temporarily diverted ambulances, and resulted in canceled appointments and procedures. A relatively new ransomware group known as BYOD claimed responsibility for the incident, alleging that it had compromised thousands of systems and obtained sensitive information.
What happened next was somewhat unusual. The group publicly apologized, claiming it had not realized that some of the affected systems supported active patient care. BYOD reportedly offered free decryption keys for healthcare-related devices and even suggested providing financial compensation to affected patients. For an organization whose business model revolves around extortion, this was an interesting response.
Of course, there was a catch. Despite the apology, the group reportedly maintained that it would retain the information it claimed to have stolen. The university also disputed aspects of the attackers' account, meaning the full extent of the alleged compromise remains uncertain. This raises an interesting question: Was the apology an expression of genuine remorse, an attempt to manage public perception, or simply a calculated decision to protect the group's reputation?
The answer may involve more than one of those motivations. Interestingly enough, we've seen similar behavior before.
Remember When LockBit Apologized for Attacking a Children's Hospital?
In December 2022, the notorious LockBit ransomware operation became associated with an attack against the Hospital for Sick Children, commonly known as SickKids, in Toronto, Canada. The attack disrupted hospital systems, delayed laboratory and imaging results, and interfered with clinical operations. For a hospital treating seriously ill children, even temporary interruptions can have significant consequences.
Then, in an unexpected turn of events, LockBit issued a public apology. The group claimed that the affiliate responsible for the attack had violated its internal rules restricting attacks against certain healthcare organizations. LockBit stated that it had removed the affiliate from its program and offered the hospital a free decryptor to assist with recovery.
The apology became public around the beginning of January 2023, although the attack itself occurred on December 18, 2022. SickKids acknowledged the decryptor offer but ultimately restored its systems without paying a ransom. The hospital also reported that it had not used the decryptor as of January 5.
Now, it's important to put this into perspective. LockBit was not suddenly becoming an ethical organization. The group continued to conduct ransomware operations against victims around the world and remained one of the most prolific ransomware threats of its time. However, the incident highlighted something that is often overlooked in discussions about cybercrime: even criminal organizations can have internal policies, expectations, and consequences for members who violate them.
Whether those rules reflect genuine moral boundaries or simply an effort to avoid unwanted attention is another matter entirely.
The Psychology Behind Criminal Organizations
So why would a criminal organization that makes money through extortion establish rules about who can and cannot be attacked? At first glance, it seems contradictory. If an organization is already willing to break the law, why draw the line at certain victims?
The answer becomes a little clearer when we look at ransomware operations as businesses rather than simply groups of hackers.
Many ransomware organizations operate under a ransomware-as-a-service (RaaS) model. The core operators develop and maintain the malware, payment infrastructure, and supporting services, while affiliates carry out intrusions and deploy ransomware against victims. The profits are then divided between the parties. Although these operations exist outside the law, they still depend on many of the same organizational dynamics found in legitimate businesses, including leadership, internal policies, reputation, financial incentives, and relationships between members.
Reputation is particularly interesting in this environment. Criminal organizations rely on credibility within underground communities to attract affiliates, establish partnerships, and maintain profitable operations. A group that becomes known for unpredictable behavior, failing to honor agreements, or attracting excessive law enforcement attention may find itself at a competitive disadvantage. As a result, some ransomware operators establish restrictions against attacking hospitals, schools, charities, or other sensitive organizations.
These restrictions aren't necessarily rooted in compassion. Attacking a children's hospital, for example, can generate significant public backlash and attract attention from law enforcement agencies that might otherwise be focused elsewhere. From a purely financial perspective, the potential consequences may outweigh the value of the ransom.
That said, we shouldn't automatically dismiss the possibility that individual criminals have personal moral boundaries. Human behavior is rarely that simple. People are capable of rationalizing harmful actions while simultaneously believing that certain other actions cross an unacceptable line. A ransomware operator might justify extorting a large corporation while viewing an attack against a children's hospital as morally unacceptable.
Psychologists sometimes describe related behavior through the concept of moral disengagement, in which individuals rationalize or minimize harmful conduct to reconcile their actions with their self-image. For example, an attacker may convince themselves that stealing from a large corporation is relatively harmless because the organization has insurance or sufficient financial resources to recover. That same individual may struggle to rationalize an attack that directly interferes with patient care.
This doesn't excuse the behavior, nor does it mean every ransomware operator thinks this way. But it offers one possible explanation for how individuals can participate in criminal activity while maintaining their own sense of right and wrong.
The BYOD and LockBit incidents are especially interesting when viewed through this lens. In both cases, the organizations publicly attempted to distinguish between the criminal activity they considered acceptable and conduct they claimed violated their boundaries. Whether those statements reflected genuine beliefs, reputational concerns, or a combination of the two is difficult to determine.
Why Understanding These Differences Matters
From a cyber threat intelligence perspective, this is where the discussion becomes particularly valuable. We spend considerable time studying malware families, infrastructure, indicators of compromise, and tactics, techniques, and procedures. All of that information is essential for understanding how adversaries operate, but it doesn't necessarily explain why they make certain decisions.
Threat actors are not a monolith. Even within the financially motivated ransomware ecosystem, organizations can have vastly different targeting preferences, risk tolerances, operational structures, and motivations. Some groups deliberately target healthcare organizations because disrupting critical services can increase pressure to pay. Others publicly discourage those attacks because of the potential consequences. Still others may establish restrictions that their affiliates simply choose to ignore.
Understanding these differences can help intelligence analysts better evaluate victimology, anticipate targeting patterns, and assess how an adversary might behave under different circumstances. A group's history of honoring or violating its own policies may also provide insight into its organizational discipline and the reliability of its public statements.
It's equally important to recognize that criminal communications are themselves a form of strategic behavior. When a ransomware group publishes an apology, announces targeting restrictions, or claims to have punished an affiliate, that information shouldn't automatically be accepted at face value. These statements may provide valuable intelligence, but they should be evaluated alongside observed activity and independently verified evidence.
In fact, the gap between what an organization claims to believe and how it actually behaves can be one of the most revealing aspects of threat actor analysis.
BYOD's reported willingness to retain stolen information despite apologizing for disrupting healthcare services illustrates that contradiction. Similarly, LockBit's apology following the SickKids incident did not erase the harm caused by the attack or establish that the organization consistently adhered to its stated restrictions.
Both incidents demonstrate why we should distinguish between an adversary's stated intentions and its demonstrated behavior.
Looking Beyond the Malware
One of the things I find most fascinating about cyber threat intelligence is the human element. Behind every ransomware operation are individuals making decisions based on financial incentives, personal beliefs, organizational pressures, and perceptions of risk. Those decisions influence everything from which victims are selected to how attacks unfold and how groups respond when their actions attract unwanted attention.
Understanding those dynamics doesn't require sympathizing with cybercriminals or minimizing the harm they cause. It simply means recognizing that criminal organizations are complex, and their behavior cannot always be explained by financial motivation alone.
The recent BYOD apology, much like LockBit's response to the SickKids attack in 2022, offers an interesting reminder that even within the ransomware ecosystem, there are differences in how organizations define acceptable conduct. Those boundaries may be inconsistent, self-serving, or entirely performative, but examining them can still provide valuable insight into the adversary.
Ultimately, threat intelligence is about more than identifying malicious activity. It's about understanding the people, motivations, and decision-making processes behind it.
Malware can tell us how an attack happened. Understanding the adversary helps us explore why it happened, and what they might do next.
And that's why the psychology behind cybercrime deserves just as much attention as the technical aspects of the attacks themselves.
Sources and Further Reading
University of New Mexico Health Sciences Center — Official communications regarding the October 2026 cybersecurity incident and operational disruptions.
The Record by Recorded Future — Reporting on the University of New Mexico cyberattack, restoration efforts, and BYOD's claims.
Healthcare IT News — January 2023 reporting on LockBit's apology following the SickKids ransomware attack.
The Hospital for Sick Children (SickKids) — Official statements issued January 1 and January 5, 2023, regarding the ransomware incident, decryptor offer, and recovery.
Albert Bandura, Moral Disengagement: How People Do Harm and Live with Themselves (2016) — Background on the psychological mechanisms through which individuals rationalize harmful behavior.
Comments