Abstract:Exploiting the anonymous mechanism of Bitcoin, ransomware activities demanding ransom in bitcoins have become rampant in recent years. Several existing studies quantify the impact of ransomware activities, mostly focusing on the amount of ransom. However, victims’ reactions in Bitcoin that can well reflect the impact of ransomware activities are somehow largely neglected. Besides, existing studies track ransom transfers at the Bitcoin address level, making it difficult for them to uncover the patterns of ransom transfers from a macro perspective beyond Bitcoin addresses. In this article, we conduct a large-scale analysis of ransom payments, ransom transfers, and victim migrations in Bitcoin from 2012 to 2021. First, we develop a fine-grained address clustering method to cluster Bitcoin addresses into users, which enables us to identify more addresses controlled by ransomware criminals. Second, motivated by the fact that Bitcoin activities and their participants already formed stable industries, such as Darknet and Miner , we train a multi-label classification model to identify the industry identifiers of users. Third, we identify ransom payment transactions and then quantify the amount of ransom and the number of victims in 63 ransomware activities. Finally, after we analyze the trajectories of ransom transferred across different industries and track victims’ migrations across industries, we find out that to obscure the purposes of their transfer trajectories, most ransomware criminals (e.g., operators of Locky and Wannacry) prefer to spread ransom into multiple industries instead of utilizing the services of Bitcoin mixers. Compared with other industries, Investment is highly resilient to ransomware activities in the sense that the number of users in Investment remains relatively stable. Moreover, we also observe that a few victims become active in the Darknet after paying ransom. Our findings in this work can help authorities deeply understand ransomware activities in Bitcoin. While our study focuses on ransomware, our methods are potentially applicable to other cybercriminal activities that have similarly adopted bitcoins as their payments.

On the Economics of Ransomware

Winning the Ransomware Lottery: A Game-Theoretic Model for Mitigating Ransomware Attacks

Economic Analysis of Ransomware

Game Theory of Data-selling Ransomware

Should the Ransomware Be Paid

It's more than just money: The real-world harms from ransomware attacks

Money Over Morals: A Business Analysis of Conti Ransomware

Determination of Ransomware Payment Based on Bayesian Game Models

Taming the Ransomware Threats: Leveraging Prospect Theory for Rational Payment Decisions

Ransomware Reloaded: Re-examining Its Trend, Research and Mitigation in the Era of Data Exfiltration

Showing the Receipts: Understanding the Modern Ransomware Ecosystem

Volenti non fit injuria: Ransomware and its Victims

An Empirical Study of Data Disruption by Ransomware Attacks

Preventive portfolio against data-selling ransomware—A game theory of encryption and deception

A Survey on Windows-based Ransomware Taxonomy and Detection Mechanisms

Ransomware deployment methods and analysis: views from a predictive model and human responses

A Prevention and a Traction System for Ransomware Attacks

A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions

Ransomware Payments in the Bitcoin Ecosystem

Introduction of the ARDS—Anti-Ransomware Defense System Model—Based on the Systematic Review of Worldwide Ransomware Attacks

A Large-scale Empirical Analysis of Ransomware Activities in Bitcoin