Abstract:We are experiencing the worst years of ransomware attacks with continuing news reports on high-profile ransomware attacks on organizations such as hospitals, schools, government agencies and private businesses. Recently a few ransomware attackers have gone beyond simply encrypting files and waiting for ransom. They threaten to release the data if the victims refuse their ransom request. In this paper, we propose a hypothetical new revenue model for the ransomware, i.e., selling the stolen data rather than publishing the data for free. Through a game-theoretical analysis between attackers and victims, we contribute a novel model to understand the critical decision variables for the proposed data-selling ransomware (which we refer as "ransomware 2.0") that sells data as well as demands ransom. We compare the role of reputation and the profitability of the data-selling ransomware with traditional ransomware ("ransomware 1.0") that demands ransom only and the data-threat ransomware ("ransomware 1.5") that demands ransom with the threat of releasing data for no compliance. Both theoretical modeling and simulation studies suggest that in general both ransomware 2.0 and 1.5 are more profitable than ransomware 1.0, while ransomware 2.0 is always more profitable than ransomware 1.5. Notably, common defensive measures that may work to eliminate the financial incentives of ransomware 1.0 may not work on ransomware 2.0, in particular the data backup practice and the never-pay-ransom strategy. Our findings also suggest that the uncertainties created by this new revenue model may affect attackers' reputation and users' willingness-to-pay, therefore, ransomware 2.0 may not always increase the profitability of attackers. Another finding of the study suggests that reputation maximization is critical in ransomware 1.0 and 1.5, but not in ransomware 2.0, where attackers could manipulate reputation for profit maximization.

Preventive portfolio against data-selling ransomware—A game theory of encryption and deception

Game Theory of Data-selling Ransomware

Information Security Problem Research Based on Game Theory

Winning the Ransomware Lottery: A Game-Theoretic Model for Mitigating Ransomware Attacks

Economic Analysis of Ransomware

On the Economics of Ransomware

Taming the Ransomware Threats: Leveraging Prospect Theory for Rational Payment Decisions

Should the Ransomware Be Paid

An Empirical Study of Data Disruption by Ransomware Attacks

Determination of Ransomware Payment Based on Bayesian Game Models

Ransomware Reloaded: Re-examining Its Trend, Research and Mitigation in the Era of Data Exfiltration

Crypto-Ransomware and Their Defenses: In-depth Behavioral Characterization, Discussion of Deployability, and New Insights

A Privacy Protection Model of Data Publication Based on Game Theory

Ransomware deployment methods and analysis: views from a predictive model and human responses

A Ransomware Classification Framework Based on File-Deletion and File-Encryption Attack Structures

Research on the evolution of tripartite data protection strategy based on game theory

A Prevention and a Traction System for Ransomware Attacks

Fight Malware Like Malware: A New Defense Method Against Crypto Ransomware

Entropy Sharing in Ransomware: Bypassing Entropy-Based Detection of Cryptographic Operations

A Game-theoretic Taxonomy and Survey of Defensive Deception for Cybersecurity and Privacy

Optimal Decision Making Approach for Cyber Security Defense Using Evolutionary Game.