The organized activities of ransomware groups: A social network approach

Using Social Network Analysis (SNA), our study examines how cybercriminals organize and operate within Ransomware-as-a-Service (RaaS) networks by analyzing connections between 96 cybercriminals and 140 ransomware groups. We compared these online criminal networks to traditional organized crime groups to better understand their structure and operations. Initially, we expected to find RaaS networks operating similarly to traditional criminal organizations—with tight connections, central leadership, and close-knit teams. However, our analysis revealed that RaaS networks are more loosely organized and decentralized, with members being spread out rather than clustered in tight groups. However, similar to traditional organized crime groups, certain individuals play crucial roles as network "hubs" or "brokers" in RaaS networks. These key players maintain connections across different parts of the network and facilitate information sharing. Our statistical analyses, based on Ordinary Least Squares regression models with log-transformed outcomes, showed that individuals with more direct connections tend to be network “brokers”, helping bridge different parts of the network. These findings suggest that while ransomware groups share some similarities with traditional organized crime, they operate in distinct ways. By identifying and targeting key network players who keep ransomware operations running, law enforcement may be more effective in disrupting these criminal networks. • Sought to compare traditional and cyber forms of organized crime. • Examined 96 individual actors and 140 ransomware groups in Ransomware-as-a-Service (RaaS) networks. • Unlike traditional organized crime, RaaS networks are sparse, decentralized, and moderately clustered. • Directly connected “broker” nodes are key intermediaries for information exchange. • Law enforcement should focus on identifying and removing “broker” nodes from cybercrime networks.