Abstract:Exploiting the anonymous mechanism of Bitcoin, ransomware activities demanding ransom in bitcoins have become rampant in recent years. Several existing studies quantify the impact of ransomware activities, mostly focusing on the amount of ransom. However, victims’ reactions in Bitcoin that can well reflect the impact of ransomware activities are somehow largely neglected. Besides, existing studies track ransom transfers at the Bitcoin address level, making it difficult for them to uncover the patterns of ransom transfers from a macro perspective beyond Bitcoin addresses. In this article, we conduct a large-scale analysis of ransom payments, ransom transfers, and victim migrations in Bitcoin from 2012 to 2021. First, we develop a fine-grained address clustering method to cluster Bitcoin addresses into users, which enables us to identify more addresses controlled by ransomware criminals. Second, motivated by the fact that Bitcoin activities and their participants already formed stable industries, such as Darknet and Miner , we train a multi-label classification model to identify the industry identifiers of users. Third, we identify ransom payment transactions and then quantify the amount of ransom and the number of victims in 63 ransomware activities. Finally, after we analyze the trajectories of ransom transferred across different industries and track victims’ migrations across industries, we find out that to obscure the purposes of their transfer trajectories, most ransomware criminals (e.g., operators of Locky and Wannacry) prefer to spread ransom into multiple industries instead of utilizing the services of Bitcoin mixers. Compared with other industries, Investment is highly resilient to ransomware activities in the sense that the number of users in Investment remains relatively stable. Moreover, we also observe that a few victims become active in the Darknet after paying ransom. Our findings in this work can help authorities deeply understand ransomware activities in Bitcoin. While our study focuses on ransomware, our methods are potentially applicable to other cybercriminal activities that have similarly adopted bitcoins as their payments.

An Empirical Study of Data Disruption by Ransomware Attacks

Travelling the Hypervisor and SSD: A Tag-Based Approach Against Crypto Ransomware with Fine-Grained Data Recovery

Ransomware Reloaded: Re-examining Its Trend, Research and Mitigation in the Era of Data Exfiltration

Crypto-Ransomware and Their Defenses: In-depth Behavioral Characterization, Discussion of Deployability, and New Insights

Showing the Receipts: Understanding the Modern Ransomware Ecosystem

An exploratory data analysis of malware/ransomware cyberattacks: insights from an extensive cyber loss dataset

Economic Analysis of Ransomware

A Survey on Windows-based Ransomware Taxonomy and Detection Mechanisms

A Large-scale Empirical Analysis of Ransomware Activities in Bitcoin

Ransomware deployment methods and analysis: views from a predictive model and human responses

A Survey of Crypto Ransomware Attack Detection Methodologies: An Evolving Outlook

A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions

A comprehensive analysis combining structural features for detection of new ransomware families

Money Over Morals: A Business Analysis of Conti Ransomware

A Prevention and a Traction System for Ransomware Attacks

Limits of I/O Based Ransomware Detection: An Imitation Based Attack.

Volenti non fit injuria: Ransomware and its Victims

Ransomware: A Rising Threat of new age Digital Extortion

A Ransomware Classification Framework Based on File-Deletion and File-Encryption Attack Structures

GuardFS: a File System for Integrated Detection and Mitigation of Linux-based Ransomware

Cryptographic ransomware encryption detection: Survey