Abstract:We are experiencing the worst years of ransomware attacks with continuing news reports on high-profile ransomware attacks on organizations such as hospitals, schools, government agencies and private businesses. Recently a few ransomware attackers have gone beyond simply encrypting files and waiting for ransom. They threaten to release the data if the victims refuse their ransom request. In this paper, we propose a hypothetical new revenue model for the ransomware, i.e., selling the stolen data rather than publishing the data for free. Through a game-theoretical analysis between attackers and victims, we contribute a novel model to understand the critical decision variables for the proposed data-selling ransomware (which we refer as "ransomware 2.0") that sells data as well as demands ransom. We compare the role of reputation and the profitability of the data-selling ransomware with traditional ransomware ("ransomware 1.0") that demands ransom only and the data-threat ransomware ("ransomware 1.5") that demands ransom with the threat of releasing data for no compliance. Both theoretical modeling and simulation studies suggest that in general both ransomware 2.0 and 1.5 are more profitable than ransomware 1.0, while ransomware 2.0 is always more profitable than ransomware 1.5. Notably, common defensive measures that may work to eliminate the financial incentives of ransomware 1.0 may not work on ransomware 2.0, in particular the data backup practice and the never-pay-ransom strategy. Our findings also suggest that the uncertainties created by this new revenue model may affect attackers' reputation and users' willingness-to-pay, therefore, ransomware 2.0 may not always increase the profitability of attackers. Another finding of the study suggests that reputation maximization is critical in ransomware 1.0 and 1.5, but not in ransomware 2.0, where attackers could manipulate reputation for profit maximization.

Taming the Ransomware Threats: Leveraging Prospect Theory for Rational Payment Decisions

Winning the Ransomware Lottery: A Game-Theoretic Model for Mitigating Ransomware Attacks

Should the Ransomware Be Paid

Economic Analysis of Ransomware

On the Economics of Ransomware

Determination of Ransomware Payment Based on Bayesian Game Models

Game Theory of Data-selling Ransomware

Preventive portfolio against data-selling ransomware—A game theory of encryption and deception

It's more than just money: The real-world harms from ransomware attacks

Ransomware deployment methods and analysis: views from a predictive model and human responses

Can global, extended and repeated ransomware attacks overcome the users status quo bias and cause a switch of system

Volenti non fit injuria: Ransomware and its Victims

Leveraging Reinforcement Learning in Red Teaming for Advanced Ransomware Attack Simulations

Ransomware Reloaded: Re-examining Its Trend, Research and Mitigation in the Era of Data Exfiltration

Ransomware: A Rising Threat of new age Digital Extortion

A Prevention and a Traction System for Ransomware Attacks

Money Over Morals: A Business Analysis of Conti Ransomware

Ransomware threat mitigation through network traffic analysis and machine learning techniques

A Survey of Ransomware as a Service (RaaS) and Methods to Mitigate the Attack

A Ransomware Classification Framework Based on File-Deletion and File-Encryption Attack Structures

XRAD: Ransomware Address Detection Method based on Bitcoin Transaction Relationships