# A Tale of Two Markets: Investigating the Ransomware Payments Economy

**Authors:** Kris Oosthoek, Jack Cable, Georgios Smaragdakis  
**arXiv:** [2205.05028](https://arxiv.org/abs/2205.05028)  
**Date:** 2022-05-10  
**Summary page:** https://www.summarizepaper.com/en/paper/2205.05028v1/

## Key points

- Ransomware attacks pose severe threats to governments, critical infrastructure, and corporations
- Collecting and analyzing ransomware data is crucial for designing effective defense mechanisms against these attacks
- Ransomwhere is an open crowdsourced ransomware payment tracker that has been instrumental in gathering information from victims of ransomware attacks
- Ransomwhere has provided valuable insights into the evolving structure of the ransomware payments economy, with over 13.5k ransom payments to more than 87 criminal actors and total payments exceeding $101 million
- Researchers have characterized two parallel markets within the ransomware ecosystem: commodity ransomware and Ransomware as a Service (RaaS)
- There are striking differences between these two markets in terms of how cryptocurrency resources are utilized, revenue per transaction, and ransom laundering efficiency
- It is relatively easy to identify choke points in commodity ransomware payment activity, but more difficult to do so for RaaS
- The study highlights the importance of understanding the evolving nature of the ransomware payments economy and designing effective defense mechanisms against these attacks.

## Summary

Ransomware attacks have become a major concern in recent years, posing severe threats to governments, critical infrastructure, and corporations. To better understand the spread of ransomware and design effective defense mechanisms, collecting and analyzing ransomware data is crucial. In this regard, Ransomwhere - an open crowdsourced ransomware payment tracker - has been instrumental in gathering information from victims of ransomware attacks. With over 13.5k ransom payments to more than 87 criminal actors and total payments exceeding $101 million, Ransomwhere has provided valuable insights into the evolving structure of the ransomware payments economy. Leveraging the transparency of Bitcoin - the cryptocurrency used for most ransomware payments - researchers have characterized two parallel markets within the ransomware ecosystem: commodity ransomware and Ransomware as a Service (RaaS). While commodity ransomware is typically sold on underground forums or deployed by individual attackers with limited resources, RaaS has effectively weaponized unpatched internet-facing technology of many unwitting organizations. Such organizations have significant financial interests in restoring their systems after a successful attack. The study shows that there are striking differences between these two markets in terms of how cryptocurrency resources are utilized, revenue per transaction, and ransom laundering efficiency. Although it is relatively easy to identify choke points in commodity ransomware payment activity, it is more difficult to do so for RaaS. To seed their dataset, researchers collected data from several public sources such as Paquet-Clouston et al., who collected 7,222 addresses representing approximately $12.7 million in payments belonging to various families including Locky. They also gathered 37 addresses and associated families from AT&T Alien Labs Open Threat Exchange platform. Members of the public can submit reports at Ransomwhere where they received 99 reports containing 198 addresses over a six-month period from June 2021 to December 2021. Overall, this study highlights the importance of understanding the evolving nature of the ransomware payments economy and designing effective defense mechanisms against these attacks. With the insights gained from Ransomwhere, researchers have shed light on the different markets within the ransomware ecosystem and provided valuable information for policymakers, law enforcement agencies, and cybersecurity professionals to combat this growing threat.