Assessing the Importance of Political Motivations in Ransomware Attacks

• In Event: Empirical Approaches to Cyber Conflict

Abstract

In recent years, ransomware attacks – in which a criminal dispatches a computer virus to encrypt a victim's files until she pays a ransom – have received growing international attention as a source of risk to the private sector. Although ransomware groups have traditionally been viewed as apolitical, some aspects of these attacks suggest that political motivations may play a more important role than previously believed, with Russia, in particular, becoming a de facto harbor for many actors involved in ransomware attacks. In this paper, we compare attacks from ransomware groups in Russia with and without ties to the Russian government through analysis of data on 2,000 victims posted to the dark web by 20 active ransomware group. We find that groups with known or suspected ties to the Russian government (1) attack more targets in the United States, (2) are more likely to attack public entities, such as hospitals or local governments, compared to businesses, and (3) demand higher ransoms on average than other groups. Our findings suggest that Russia's political interests may play a bigger role in the attacks carried out by ransomware groups than previously believed, which, in turn, holds important implications for international efforts to combat ransomware attacks.

Authors

• Karen Nershi, Stanford University

• Shelby Grossman, Stanford University