Ransomware’s New Masters: How States Are Hijacking Cybercrime
Contents
The third report in the Pharos Series, Ransomware’s New Masters: How States Are Hijacking Cybercrime is authored by Aleksandar Milenkoski, Jiro Minier, Julian-Ferdinand Vögele, Max Smeets, and Taylor Grossman.
Ransomware has evolved into one of the most pervasive cyber threats, with high-profile incidents disrupting government organizations and private companies alike. Beyond their financial impact, these attacks now pose direct risks to human safety. While ransomware has long been associated with non-state criminal actors, state-linked actors are increasingly deploying it to achieve their objectives as well.
This report provides a comparative analysis of ransomware use by groups linked to four states: Russia, China, North Korea, and Iran. The authors find that divergent motives and operational ecosystems contribute to varying uses of state-linked ransomware to gain strategic advantages.
Russian state-linked groups primarily leverage ransomware as an operational tool in high-tempo conflicts like Ukraine, while China often aims to enhance plausible deniability for espionage activity. Iranian …
Ransomware has evolved into one of the most pervasive cyber threats, with high-profile incidents disrupting government organizations and private companies alike. Beyond their financial impact, these attacks now pose direct risks to human safety. While ransomware has long been associated with non-state criminal actors, state-linked actors are increasingly deploying it to achieve their objectives as well.
This report provides a comparative analysis of ransomware use by groups linked to four states: Russia, China, North Korea, and Iran. The authors find that divergent motives and operational ecosystems contribute to varying uses of state-linked ransomware to gain strategic advantages.
Russian state-linked groups primarily leverage ransomware as an operational tool in high-tempo conflicts like Ukraine, while China often aims to enhance plausible deniability for espionage activity. Iranian …