The State in Ransomware: Evidence of Concentration and Targeting Patterns among Russian-Affiliated Groups

Ransomware is increasingly associated with states that seek to undermine adversaries. This work builds a theoretical argument through case studies and an open-source database of 19,128 instances of ransomware attacks that quantitatively and qualitatively identifies patterns consistent with a permissive environment within the Russian Federation for ransomware activities that target the economic and political interests of its perceived adversaries during a time of war. These ransomware attacks facilitate indirect revenues through taxation to the Russian economy and direct revenues to Russian criminal entities, undermine the economies and industries of adversaries, and occur within a Russian information environment that is highly constrained and insular. The central question of this work examines whether criminal ransomware group activities align with state interests. Russian ransomware activities likely complement other attributes of Russia’s information warfare and propaganda strategy leading to an increasingly contested digital environment. By using data-driven analysis, this work builds on prior case analyses and establishes with quantitative evidence in the form of leak-site data