Abstract:Exploiting the anonymous mechanism of Bitcoin, ransomware activities demanding ransom in bitcoins have become rampant in recent years. Several existing studies quantify the impact of ransomware activities, mostly focusing on the amount of ransom. However, victims’ reactions in Bitcoin that can well reflect the impact of ransomware activities are somehow largely neglected. Besides, existing studies track ransom transfers at the Bitcoin address level, making it difficult for them to uncover the patterns of ransom transfers from a macro perspective beyond Bitcoin addresses. In this article, we conduct a large-scale analysis of ransom payments, ransom transfers, and victim migrations in Bitcoin from 2012 to 2021. First, we develop a fine-grained address clustering method to cluster Bitcoin addresses into users, which enables us to identify more addresses controlled by ransomware criminals. Second, motivated by the fact that Bitcoin activities and their participants already formed stable industries, such as Darknet and Miner , we train a multi-label classification model to identify the industry identifiers of users. Third, we identify ransom payment transactions and then quantify the amount of ransom and the number of victims in 63 ransomware activities. Finally, after we analyze the trajectories of ransom transferred across different industries and track victims’ migrations across industries, we find out that to obscure the purposes of their transfer trajectories, most ransomware criminals (e.g., operators of Locky and Wannacry) prefer to spread ransom into multiple industries instead of utilizing the services of Bitcoin mixers. Compared with other industries, Investment is highly resilient to ransomware activities in the sense that the number of users in Investment remains relatively stable. Moreover, we also observe that a few victims become active in the Darknet after paying ransom. Our findings in this work can help authorities deeply understand ransomware activities in Bitcoin. While our study focuses on ransomware, our methods are potentially applicable to other cybercriminal activities that have similarly adopted bitcoins as their payments.

Economic Analysis of Ransomware

On the Economics of Ransomware

Game Theory of Data-selling Ransomware

Money Over Morals: A Business Analysis of Conti Ransomware

Winning the Ransomware Lottery: A Game-Theoretic Model for Mitigating Ransomware Attacks

An Empirical Study of Data Disruption by Ransomware Attacks

A Large-scale Empirical Analysis of Ransomware Activities in Bitcoin

Behind Closed Doors: Measurement and Analysis of Cryptolocker Ransoms in Bitcoin

Ransomware Payments in the Bitcoin Ecosystem

Showing the Receipts: Understanding the Modern Ransomware Ecosystem

Crypto-Ransomware and Their Defenses: In-depth Behavioral Characterization, Discussion of Deployability, and New Insights

Taming the Ransomware Threats: Leveraging Prospect Theory for Rational Payment Decisions

Ransomware Reloaded: Re-examining Its Trend, Research and Mitigation in the Era of Data Exfiltration

Ransomware deployment methods and analysis: views from a predictive model and human responses

Travelling the Hypervisor and SSD: A Tag-Based Approach Against Crypto Ransomware with Fine-Grained Data Recovery

Preventive portfolio against data-selling ransomware—A game theory of encryption and deception

Differential Area Analysis for Ransomware Attack Detection within Mixed File Datasets

A Survey on Windows-based Ransomware Taxonomy and Detection Mechanisms

A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions

Volenti non fit injuria: Ransomware and its Victims

Your files have been encrypted: a crime script analysis of ransomware attacks