The Commercialization of Ransomware: From Spray-and-Prey to Big Game Hunting to the Ransom Bazaar
Rajeev V. Gundur, Volkan Topalli, Zarina Vakhitova, Harry Kangluo Liu, Michael Levi, Charlie Winter, Alexandra Louise Anderson Baxter · Crime & Delinquency · 2026
Ransomware has evolved from opportunistic attacks into a sophisticated financial enterprise sustained by cryptocurrency markets, despite enforcement pressure. Drawing on the analysis of 525 ransomware strains (2013–2025), we identify three eras: Spray-and-Prey (2013–2018; fragmented payment practices), Big Game Hunting (2018–2021; targeting high-value organizations), and Ransom Bazaar (2021–present; financialized, service-oriented extortion). These eras are analytic ideal types that show how ransomware operators evolved their tactics, which have come to feature negotiation and flexible pricing, to adapt to cryptocurrency market conditions in ways that mirror broader financialization dynamics. This paper offers two main contributions: (1) an empirical map of payment evolution and (2) a theory of ransomware as commercial adaptation to cryptocurrency markets.