Abstract:We are experiencing the worst years of ransomware attacks with continuing news reports on high-profile ransomware attacks on organizations such as hospitals, schools, government agencies and private businesses. Recently a few ransomware attackers have gone beyond simply encrypting files and waiting for ransom. They threaten to release the data if the victims refuse their ransom request. In this paper, we propose a hypothetical new revenue model for the ransomware, i.e., selling the stolen data rather than publishing the data for free. Through a game-theoretical analysis between attackers and victims, we contribute a novel model to understand the critical decision variables for the proposed data-selling ransomware (which we refer as "ransomware 2.0") that sells data as well as demands ransom. We compare the role of reputation and the profitability of the data-selling ransomware with traditional ransomware ("ransomware 1.0") that demands ransom only and the data-threat ransomware ("ransomware 1.5") that demands ransom with the threat of releasing data for no compliance. Both theoretical modeling and simulation studies suggest that in general both ransomware 2.0 and 1.5 are more profitable than ransomware 1.0, while ransomware 2.0 is always more profitable than ransomware 1.5. Notably, common defensive measures that may work to eliminate the financial incentives of ransomware 1.0 may not work on ransomware 2.0, in particular the data backup practice and the never-pay-ransom strategy. Our findings also suggest that the uncertainties created by this new revenue model may affect attackers' reputation and users' willingness-to-pay, therefore, ransomware 2.0 may not always increase the profitability of attackers. Another finding of the study suggests that reputation maximization is critical in ransomware 1.0 and 1.5, but not in ransomware 2.0, where attackers could manipulate reputation for profit maximization.

Mathematical modeling of strategic commitments and piracy in Windows/Linux competition

Network Externalities, Software Business Models and the Market Structure of Operation System Markets: A Comparative Research of Windows and Linux

Open to Your Rival: Competition between Open Source and Proprietary Software under Indirect Network Effects

Multihoming vs. Single-Homing Software: Compatibility or Competition?

Software Design Strategies in Markets with Open Source Competitors.

The Perils of Exploration under Competition: A Computational Modeling Approach

Software Market Structure and the Optimal Intellectual Property Protection

Impact of Users' Expertise on the Competition between Proprietary and Open Source Software

Impact of User Skills and Network Effects on the Competition Between Open Source and Proprietary Software

Winning the Ransomware Lottery: A Game-Theoretic Model for Mitigating Ransomware Attacks

A competition model for two CPU vendors

Impact of Cyberattacks by Malicious Hackers on the Competition in Software Markets

A Model Predictive Stackelberg Solution to Orbital Pursuit-Evasion Game

Mathematical modeling of competition in sponsored search market

On the Economics of Ransomware

An agent-based model to study the market dynamics of perpetual and subscription licensing

Mathematical modeling of incentive mechanisms in projects for the development of new production

A Stochastic Knapsack Game: Revenue Management in Competitions

Computing Optimal Security Strategies for Interdependent Assets

Game Theory of Data-selling Ransomware