Disrupting Ransomware Group Operations: A Social Network Approach

• In Event: Exploring Online Underground Markets: Trends, Behaviors, and Prevention Initiatives

Abstract

Using unique data from 228 threat actors collected with OSINT tools, this study is the first to examine the networks formed by ransomware-focused cybercrime groups and their affiliates. The goal of the study is to understand the structure and growth of social networks that enable ransomware groups to flourish and persist despite ongoing efforts to curtail their activities. Our analyses reveal that the existing “core” group of ransomware actors remains largely untouched by law enforcement and that the connections between a small number of individuals involved in these networks need to be the key target of law enforcement efforts. Policy measures based on the identified points of network disruption are discussed.

Authors

• Ekaterina Botchkovar, Northeastern University

• Kexin Cui, Northeastern University

• Olena Antonaccio, University of Miami

• David Maimon, Georgia State University

• Robert Perkins, Georgia State University