Tracking Ransomware End-to-end

TLDR

Ransomware encrypts infected hosts’ files and demands payment, typically in Bitcoin. The study develops a measurement framework for a large‑scale, two‑year, end‑to‑end analysis of ransomware payments, victims, and operators. By combining ransomware binaries, seed ransom payments, victim telemetry, and a database of Bitcoin addresses annotated with owners, the authors trace transactions from victim acquisition through ransom payment to operator cash‑out. The analysis tracks more than $16 million USD in ransom payments from 19,750 victims over two years, shows many operators cashed out through the defunct BTC‑e exchange, and suggests the approach could extend to other Bitcoin‑based cybercrime.

Abstract

Ransomware is a type of malware that encrypts the files of infected hosts and demands payment, often in a crypto-currency like Bitcoin. In this paper, we create a measurement framework that we use to perform a large-scale, two-year, end-to-end measurement of ransomware payments, victims, and operators. By combining an array of data sources, including ransomware binaries, seed ransom payments, victim telemetry from infections, and a large database of bitcoin addresses annotated with their owners, we sketch the outlines of this burgeoning ecosystem and associated third-party infrastructure. In particular, we are able to trace the financial transactions, from the acquisition of bitcoins by victims, through the payment of ransoms, to the cash out of bitcoins by the ransomware operators. We find that many ransomware operators cashed out using BTC-e, a now-defunct Bitcoin exchange. In total we are able to track over $16 million USD in likely ransom payments made by 19,750 potential victims during a two-year period. While our study focuses on ransomware, our methods are potentially applicable to other cybercriminal operations that have similarly adopted Bitcoin as their payment channel.