Virtual Library

Our research repositories present a collection of open-source resources that showcase research and analysis that has directly influenced our initiatives. Non-IST publications are copyrighted by external authors not affiliated with IST.

Submit your Content

Reports

To the Point of Failure: Identifying Failure Points for Crisis Communications Systems

Leah Walker, Alexa Wehsener

viewpdf

Reports

Mapping the Ransomware Payment Ecosystem: A Comprehensive Visualization of the Process and Participants

Zoë Brammer

viewpdf

Reports

Plan maestro de defensa contra los programas de secuestro

Grupo de Trabajo sobre Programas de Secuestro

viewpdf

Reports

Cyber Incident Reporting Framework

Cyber Threat Alliance, Institute for Security and Technology

viewpdf

Reports

Digital Tools, Cognition, and Democracy: A Review of the Literature

Zoë Brammer, Sage Miller, Leah Walker

viewpdf

Reports

Reasoning: How digital technologies influence decision making and judgment

Stephanie Rodriguez

viewpdf

Reports

Attention: How digital technologies influence what we notice, what we focus on, and how we learn

Stephanie Rodriguez

viewpdf

Contribute to our Library!

We also welcome additional suggestions from readers, and will consider adding further resources as so much of our work has come through crowd-sourced collaboration already. If, for any chance you are an author whose work is listed here and you do not wish it to be listed in our repository, please, let us know.

SUBMIT CONTENT
Playing now

Virtual Event and Live Q&A with Mr. Nand Mulchandani, Acting Director of the U.S. Department of Defense Joint Artificial Intelligence Center

Mapping the Ransomware Payment Ecosystem: A Comprehensive Visualization of the Process and Participants

Zoë Brammer

SUMMARY

The Institute for Security and Technology’s Ransomware Task Force (RTF) is working to further illuminate the ransomware payment ecosystem as part of our efforts to improve the information environment and blunt the ability for criminal and other malign actors to profit from ransomware attacks, and thereby stop engaging in ransomware for profit.

Central to mitigating the threat of ransomware is the development of a common understanding of the actors, stakeholders, processes, and information, both required for and produced during the ransomware payment process. Yet, when we began this work, such a picture did not exist. IST undertook this effort to fill that gap. 

With a clear picture of the ransomware payment ecosystem, a number of opportunities present themselves: first, the ability to identify at what point a particular incident is in the payment process, which can allow counter-ransomware efforts to disrupt that process; second, the identification of entities involved in the process who may have opportunities to gather information and/or take action; and third, the potential to bring together disparate entities to identify additional ways add friction to and potentially disrupt the ransomware payment process, thereby complicating the ability of attackers to successfully collect on ransomware attacks.

This paper takes the first steps into a larger exploration of these opportunities. It presents a novel, comprehensive ransomware payment map and orients the reader to the actors and entities adapting to the ransomware threat. In future work, IST will begin to analyze how each entity could leverage its position to better observe the ransomware payment cycle. Future work will analyze the technical, regulatory and legal, and other requirements for these actors to access this information. IST will also outline ways those entities could add friction to the ongoing use of ransomware. Our goal is to help enable changes in the economic incentive structure around ransomware attacks, thereby reducing the use of ransomware overall.

download pdf