Power Structures and Earnings in Cybercrime: Insights from the CONTI Ransomware Group

• In Event: Organized crime: Institutions, attitudes, functioning

Abstract

The remuneration and salary structure of individuals involved in criminal groups, especially in cybercrime, are not widely known. Previous research suggests that cybercriminal groups often use a performance-based system. However, the distribution of compensations earned by individuals within criminal groups is still unclear. This study uses data from the recent Conti ransomware group leak to gain insights into the internal dynamics, power structures, and financial operations of cybercriminal organizations. This leak provides unique ground-truth data, as group members thought they were communicating in a fully safe environment. Overall, 182 wage payments to 56 members of the Conti group were collected and analyzed by the means of blockchain analysis.
Data shows an extremely skewed income distribution within the Conti group. Very few individuals have vast earnings, while most members are able to raise slightly more than their counterparts conducting similar jobs for legal institutions. The leak also provides evidence of the routinization of cybercrimes, which are now often less creative, repetitive and poorer in ideology. The combinations of these factors aliment discontent and frustration.
Understanding income distribution and personal incomes of cybercriminal group members is crucial for comprehending their behavior, motivations, and decision-making processes, and illuminating these activities and organizations.

Authors

• Alberto Aziani, Transcrime / Università Cattolica del Sacro Cuore (Milan)

• Mirko Nazzari, Università Cattolica - Transcrime (Milan)