Analysing the evolution and activities of ransomware criminal groups
Chad Whelan, David Bright, James A. Martin, Callum Jones, Benoît Dupont · Australian Institute of Criminology eBooks · 2025
Ransomware is one of the most prolific and economically damaging cybercrime threats of the contemporary era. This exploratory study aims to enhance knowledge about ransomware criminal groups, principally using crime script analysis. Our focus is on ransomware criminal groups that targeted organisations in Australia, Canada, New Zealand and the United Kingdom between 2020 and 2022. The project examines the evolution, lifespan and methods of ransomware criminal groups. Results reveal the most active ransomware criminal groups, the median range of their careers and the most targeted victim organisations by country and sector type. By combining crime script approaches with existing cybersecurity frameworks, the study advances understanding of the criminal processes used by ransomware criminal groups over time.