Ransomware might still be thriving in 2025, but cybersecurity firm Halcyon just raised the stakes for cybercriminals with a serious cash incentive for anyone willing to share what they know.
The company launched what it’s calling the Threat Research Incentive Program (TRIP), and it’s believed to be the first of its kind: a dedicated bounty program solely focused on uncovering the inner workings of ransomware groups.
With rewards of up to $250,000 on the table, Halcyon is inviting independent researchers, digital sleuths, and even casual hackers with a conscience to submit actionable intelligence that can help dismantle these criminal operations.
And while the bounty won’t make anyone instantly rich compared to ransomware kingpins, Halcyon’s taking a new approach where you can get paid to fight back.
Why It Matters: Ransomware isn’t slowing down. The people behind these attacks are getting more organized, more sophisticated, and more aggressive. That’s why turning the spotlight on them with programs like TRIP could be a game-changer. It’s about building a network of defenders who can hit cybercriminal’s secrecy.
- You Can Get Paid Up to $10,000 per Tip, No Joke: Halcyon has divided TRIP into four reward tiers based on the type and depth of information submitted. At the top, if you have fresh intelligence on ransomware groups themselves, think names, methods, Ransomware-as-a-Service (RaaS) platforms, affiliate structures, or initial access brokers, you could earn up to $10,000 per accepted submission. This tier is aimed at those with insider-level insight or the kind of OSINT digging that uncovers key actors.
- Technical Intel Gets You Paid Too, Even the Small Stuff: If you’re the kind of person who likes reverse engineering malware or exploring attacker infrastructure, you could still be eligible for significant rewards. Submissions about malware tools, evasion tricks, C2 infrastructure, and other tactics fall into Tier 2, with rewards up to $5,000. Halcyon’s not just after names, they want to understand how these operations function and evolve.
- Droppers, Loaders, Packers? There’s a Bounty for That: Even tools that may seem more “behind the scenes” to a casual observer. like droppers or packers used to deliver ransomware payloads, are valuable to Halcyon. These fall under Tier 3, which offers up to $3,000. If you’re watching malware in the wild and notice a new delivery method or suspicious executable, it could be worth something.
- Even Behavior Patterns and Indicators Matter: Not all intelligence needs to be flashy. Tier 4 rewards insights into behavior chains and indicators of compromise (IOCs), the kind of breadcrumbs that help defenders recognize an attack in progress. These submissions can earn you up to $1,000, proving that even small, repeatable signs of ransomware activity are valuable when aggregated and analyzed.
- There Are Some Strings Attached (And They Make Sense): Halcyon is clear that no rewards will go to anyone affiliated with ransomware or extortion groups, nor anyone on the U.S. Office of Foreign Assets Control (OFAC) sanctions list. This keeps the program clean and above-board. But otherwise, whether you’re a full-time security researcher or just a passionate amateur with good instincts, they want to hear from you.
Go Deeper -> Ransomware Snitches Wanted — $250,000 Bounty Offered – Forbes
